AWS CLI v2 operator

Answer common AWS CLI questions with concise, safety-aware commands for identity, regions, S3, EC2, Lambda, ECS, ECR, CloudWatch, IAM, and CloudFormation. Use when the user wants a quick reference, flag explanation, or command translation.

Validate CloudFormation templates and inspect stacks, events, resources, drift, and change sets with replacement and rollback awareness. Use when a stack fails, a deployment needs preview, or infrastructure state must be explained.

Attribute account changes using CloudTrail, covering event history lookup by resource, user, or event name, the management and data event distinction, reading the identity behind an assumed role or federated session, querying a trail in Athena or CloudWatch Logs, event time windows and delivery lag, and separating a human action from an automated one. Use when someone must find who changed or deleted a resource, when an unexpected change must be attributed, or when an access question needs evidence.

Query AWS CloudWatch logs, metrics, alarms, dashboards, and time windows for operational evidence. Use when investigating failures, checking service health, finding recent errors, or validating an approved alerting change.

Report AWS spend and find what drove a change, covering Cost Explorer queries grouped by service, account, or tag, month-over-month and daily comparisons, unblended versus amortized cost, forecasts, budgets and alerts, untagged spend, and the usual sources of a sudden increase. Use when a bill must be explained, when spend has jumped, when a budget or alert must be created, or when cost must be attributed to a team or project.

Deploy a change to a running AWS service and roll it back, covering the immutable-artifact rule, deploying by digest or version, waiting for stability rather than assuming it, health checks and draining, verifying the user-visible objective, rollback by redeploying the previous identifier, and separating a code deploy from a configuration or schema change. Use when a change must reach a running service, when a deploy must be verified, or when a bad deploy must be reverted.

Inspect and operate EC2 instances, status checks, volumes, tags, and security groups with explicit target resolution and safety gates. Use when starting, stopping, rebooting, connecting to, diagnosing, or inventorying EC2 resources.

Inspect Amazon ECR repositories, image tags, digests, scan findings, and Docker authentication with reproducible, safety-aware workflows. Use when publishing, pulling, identifying, or troubleshooting container images in ECR.

Inspect Amazon ECS clusters, services, tasks, task definitions, deployments, and execution behavior with bounded targets and rollout verification. Use when an ECS service is unhealthy, a task will not start, or a deployment needs investigation.

Inspect AWS CLI profiles, credentials, identity, region, SSO, and execution context safely. Use when the AWS account, role, region, profile, or CLI setup is unknown or when a command might target the wrong environment.

Inspect AWS IAM users, roles, policies, permission boundaries, trust relationships, and simulated access without weakening security. Use when an action is denied, a role is unclear, or access needs evidence-based analysis.

Connect AWS to the systems around it, covering CI pipeline authentication with short-lived OpenID Connect roles, container image publishing to ECR, infrastructure-as-code state and drift, application runtime configuration from Secrets Manager and Parameter Store, and local development against cloud resources. Use when a pipeline needs AWS credentials, when a deploy must publish an image or update a service, when an application must read configuration at runtime, or when local development needs to reach a cloud resource.

Inspect, invoke, update, publish, and troubleshoot AWS Lambda functions with explicit aliases, versions, payloads, and logs. Use when a function fails, needs a controlled test, or requires a carefully scoped deployment change.

Discover, compatibility-check, install, update, or explain AWS's first-party Agent Toolkit skills for AWS CLI v2. Use when asked about AWS native skills, Agent Toolkit for AWS, aws agent-toolkit, or whether installed AWS skills match this AWS CLI v2 operator.

Inspect and operate RDS and Aurora databases, covering instance and cluster state, endpoints and parameter groups, snapshots and point-in-time restore, storage and connection metrics, maintenance and pending modifications, failover, and the difference between an immediate change and one deferred to a maintenance window. Use when a database must be inspected, snapshotted, restored, resized, or its maintenance state understood.

Inspect and change Route 53 DNS, covering hosted zones and delegation, record types and alias records, change batches and propagation, time-to-live choices, health checks and failover routing, private zones, and diagnosing a lookup that returns the wrong answer or nothing. Use when a DNS record must be read or changed, when a domain does not resolve, or when a cutover needs a safe time-to-live plan.

Operate AWS S3 buckets and objects with explicit paths, region checks, dry runs, and post-change verification. Use when listing, inspecting, copying, syncing, uploading, downloading, or troubleshooting S3 data and bucket access.

Read, create, and rotate values in AWS Secrets Manager and SSM Parameter Store without printing them, covering listing by name, retrieving a single field, versions and staging labels, rotation, encryption keys, resource policies, and choosing between the two stores. Use when an application needs a secret or parameter, when a value must be created or rotated, or when a secret has to be inspected without disclosing it.

Install the AWS CLI and configure profiles, IAM Identity Center single sign-on, static access keys, role assumption, default regions, output formats, and credential precedence, then verify the identity the CLI actually resolves. Use when the AWS CLI is missing or out of date, when a profile must be created or repaired, when single sign-on needs configuring, or when the user asks how to get credentials working on a new machine.

Reach EC2 instances and private services through AWS Systems Manager, covering Session Manager shells, Run Command across a target set, port forwarding to a private database, session logging, and the agent and instance-profile prerequisites. Use when an instance must be reached without a bastion or an inbound rule, when a command must run across several instances, or when a private endpoint must be forwarded to a local port.

Diagnose AWS CLI and service failures from reproducible evidence, covering credentials, account and region context, authorization, throttling, resource state, networking, logs, deployments, and eventual consistency. Use when an AWS command errors or a resource behaves unexpectedly.

Inspect AWS networking and prove reachability, covering VPCs and subnets, route tables and gateways, security groups and network ACLs, the stateful versus stateless distinction, Reachability Analyzer, flow logs, and endpoints for private service access. Use when traffic cannot reach a resource, when a security group or route must be understood or changed, or when a network path must be proven rather than guessed.