About

Imported from sickn33/agentic-awesome-skills (skills/hf-cloud-aws-context-discovery/SKILL.md). Install upstream with npx skills add sickn33/agentic-awesome-skills --skill hf-cloud-aws-context-discovery. Copyright stays with the author (Apache-2.0).

AWS Context Discovery

Name: hf-cloud-aws-context-discovery
Author: sickn33

Before doing any AWS work, inspect only masked AWS CLI metadata. Don't guess the region, and don't ask the user for things the CLI already answers. Never open or print ~/.aws/credentials, credential-process output, secret environment variables, access keys, session tokens, or SSO token caches.

When to Use

Establish the effective AWS profile, region, account, and caller before AWS work.
Diagnose expired SSO sessions, missing profiles, or configuration overrides.
Provide verified context to later SageMaker planning and deployment skills.

What to discover

Run these at the start of the AWS work and remember the results for the rest of the session.

1. Active profile

Use a profile the user explicitly named, otherwise use the profile identified by masked AWS CLI metadata. If the named profile is absent from aws configure list-profiles, surface that clearly.

2. Region

Resolution order — stop at the first one that produces a value:

Region the user explicitly named in this conversation
Region reported by aws configure list --profile "$profile"
Region reported by aws configure get region --profile "$profile"
Ask the user — but only after the first four have failed

Do not fall back to us-east-1 or any other hardcoded default.

3. Credentials, account ID, caller ARN

aws sts get-caller-identity --profile "$profile" --region "$region"

Three purposes in one call: confirms credentials are valid (stop if not), returns the Account ID (needed for ARN construction), returns the Arn of the caller.

4. Identify SSO / assumed-role principals

The Arn field tells you what kind of principal this is. The pattern matters because it determines what IAM operations the caller can do.

ARN pattern	Type	IAM write capability
`arn:aws:iam::<acct>:user/<name>`	IAM user	Depends on attached policies
`arn:aws:sts::<acct>:assumed-role/AWSReservedSSO_<...>/<email>`	SSO assumed-role	Typically none — can't create/modify IAM roles
`arn:aws:sts::<acct>:assumed-role/<role>/<session>`	Regular assumed-role	Depends on the role

If the caller is SSO, surface this immediately before later skills hit iam:CreateRole and fail:

Heads up: you're authenticated via SSO (AWSReservedSSO_<PermissionSet>_...). SSO principals usually can't create IAM roles directly. If we need a SageMaker execution role, I'll look for an existing one first — if none exists, you'll need to ask whoever manages your AWS access to create one.

This is the highest-leverage thing this skill does. Surfacing it now turns a confusing mid-deployment error into a five-second conversation.

Commands to run

# Profiles and masked effective metadata; never read credential files directly
aws configure list-profiles
aws configure list --profile "$profile"
aws configure get region --profile "$profile"

# Validate credentials and get identity
aws sts get-caller-identity --profile "$profile" --region "$region"

aws configure list masks credential values and identifies their source. Use these metadata commands instead of parsing AWS files or inspecting secret-bearing environment variables. If the CLI cannot resolve a profile or region without exposing credentials, stop and ask the user for the non-secret profile or region value.

What to report back

One or two lines, not a wall of text:

Working with profile my-profile in eu-west-1, account 123456789012. You're authenticated via SSO, so we'll need to use an existing IAM role rather than create one.

Don't ask the user to confirm the region you just read from their config — they configured it; that is the confirmation.

If something is wrong (credentials expired, profile doesn't exist, no region anywhere), stop and surface the specific error before continuing.

Limitations

Discovery may reveal account IDs, role ARNs, or profile names; report only what the task needs and never expose secrets or session tokens.
STS identity checks require network access and valid credentials.
A valid identity does not imply permission to change resources.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/sickn33-agentic-awesome-skills-hf-cloud-aws-context-discovery/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

sickn33-agentic-awesome-skills-hf-cloud-aws-context-discovery.ocm.jsonjson

{
  "ocm": "1",
  "id": "sickn33-agentic-awesome-skills-hf-cloud-aws-context-discovery",
  "kind": "skill",
  "name": "hf-cloud-aws-context-discovery",
  "description": "Discover the effective local AWS profile, region, account, and caller identity before any AWS task without exposing credentials.",
  "publisher": "sickn33",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "hugging-face",
      "aws",
      "credentials",
      "discovery",
      "cloud",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Discover the effective local AWS profile, region, account, and caller identity before any AWS task without exposing credentials."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/sickn33/agentic-awesome-skills",
      "path": "skills/hf-cloud-aws-context-discovery/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/sickn33/agentic-awesome-skills/blob/HEAD/skills/hf-cloud-aws-context-discovery/SKILL.md",
      "key": "sickn33/agentic-awesome-skills/skills/hf-cloud-aws-context-discovery/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# AWS Context Discovery\n\nBefore doing any AWS work, inspect only masked AWS CLI metadata. Don't guess the region, and don't ask the user for things the CLI already answers. Never open or print `~/.aws/credentials`, credential-process output, secret environment variables, access keys, session tokens, or SSO token caches.\n\n## When to Use\n\n- Establish the effective AWS profile, region, account, and caller before AWS work.\n- Diagnose expired SSO sessions, missing profiles, or configuration overrides.\n- Provide verified context to later SageMaker planning and deployment skills.\n\n## What to discover",
  "cost": {
    "context_tokens": 1042
  }
}

Fetch it by URL: GET /api/v1/registry/sickn33-agentic-awesome-skills-hf-cloud-aws-context-discovery/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.