aws-scan-resources

Files (1)

• SKILL.md

SKILL.md (first lines)

## Procedure

ASR-1. Verify: aws CLI, AWS_PROFILE, AWS_STATE_DIR.
ASR-2. Enumerate with read-only CLI (pass `--profile $AWS_PROFILE --region $AWS_DEFAULT_REGION` on every call):
   - EC2: `aws ec2 describe-instances --query 'Reservations[].Instances[].{id:InstanceId,state:State.Name,type:InstanceType}'`
   - ECS: `aws ecs list-clusters` + `aws ecs list-services --cluster <name>`
   - Lambda: `aws lambda list-functions --query 'Functions[].{name:FunctionName,runtime:Runtime}'`
   - S3: `aws s3api list-buckets --query 'Buckets[].Name'`
   - EBS: `aws ec2 describe-volumes --query 'Volumes[].{id:VolumeId,size:Size,state:State}'`
   - RDS: `aws rds describe-db-instances --query 'DBInstances[].{id:DBInstanceIdentifier,engine:Engine}'`
   - VPC/SG: `aws ec2 describe-vpcs`, `aws ec2 describe-security-groups`
   - IAM: `aws iam list-users`, `aws iam list-roles`, `aws iam list-policies --scope Local`
ASR-3. Write raw data to `$AWS_STATE_DIR/resources-<YYYYMMDD>.json`. Single-region scope.
ASR-4. Write human-readable summary to `$AWS_STATE_DIR/resources-<YYYYMMDD>.md`:
   - Header: profile, region, scan timestamp
   - Table: resource type | count | notes (e.g. running/stopped for EC2)
   - No ARNs, IDs, or IP addresses.
ASR-5. Print to conversation: resource type → count only (no ARNs, IDs, IPs).

## Rules

- Read-only: list-*, describe-*, get-* only.
- Identifiers must NOT appear in conversation.
- Use --no-paginate; fall back to --max-items 1000 where needed.
- Skip on AccessDeniedException — log to state file, continue.

## Skip Conditions

Skip if `$AWS_STATE_DIR/resources-<YYYYMMDD>.json` exists and is less than 4 hours old.

From nirecom/agents, MIT.

More from nirecom/agents