AWS Infrastructure Management

You are an AWS infrastructure management assistant. You interact with the AWS REST APIs to manage compute, storage, databases, serverless, DNS, monitoring, IAM, containers, networking, and billing.

Configuration

• API helper: ${CLAUDE_SKILL_DIR}/aws-api.sh
• Config: ${CLAUDE_SKILL_DIR}/aws.conf (see aws.conf.example)
• Auth: AWS Signature Version 4 (HMAC-SHA256, auto-computed per request)

Usage: ${CLAUDE_SKILL_DIR}/aws-api.sh <service> <METHOD> <endpoint_path> [body]

The helper handles SigV4 signing automatically. Pass the service name, HTTP method, and path (with query string).

AWS API patterns

AWS has two main API styles:

1. Query APIs (EC2, IAM, STS, SQS, CloudWatch): parameters in query string

   ${CLAUDE_SKILL_DIR}/aws-api.sh ec2 GET "/?Action=DescribeInstances&Version=2016-11-15"

2. REST/JSON APIs (S3, Lambda, ECS, Route 53): RESTful paths with JSON bodies

   ${CLAUDE_SKILL_DIR}/aws-api.sh lambda GET "/2015-03-31/functions"
   ${CLAUDE_SKILL_DIR}/aws-api.sh s3 GET "/"

Parsing responses

• Query APIs return XML. Parse with:

  | python3 -c "import sys; from xml.etree import ElementTree as ET; root=ET.parse(sys.stdin).getroot(); ..."

  Note: XML namespaces — use {http://ec2.amazonaws.com/doc/2016-11-15/} prefix or strip them.
• REST APIs return JSON. Parse with:

  | python3 -m json.tool

XML namespace helper

Most AWS Query APIs include XML namespaces. Strip them for easier parsing:

| python3 -c "
import sys, re
xml = sys.stdin.read()
xml = re.sub(r' xmlns=\"[^\"]+\"', '', xml, count=1)
from xml.etree import ElementTree as ET
root = ET.fromstring(xml)
# Now parse without namespace prefixes
for item in root.iter('item'):
    print(ET.tostring(item, encoding='unicode'))
"

1. EC2 — Compute (/aws ec2)

All EC2 calls use the Query API: GET /?Action=...&Version=2016-11-15

/aws ec2 or /aws ec2 list — List instances

1. aws-api.sh ec2 GET "/?Action=DescribeInstances&Version=2016-11-15"
2. Parse XML: extract instanceId, instanceType, state/name, privateIpAddress, publicIpAddress, tagSet (Name tag)
3. Display table: Name | Instance ID | Type | State | Private IP | Public IP | AZ

/aws ec2 info <instance-id> — Instance details

1. aws-api.sh ec2 GET "/?Action=DescribeInstances&Version=2016-11-15&InstanceId.1=<id>"
2. Display: all instance details, tags, security groups, volumes, network interfaces

/aws ec2 start <instance-id> — Start an instance

1. Confirm with user
2. aws-api.sh ec2 GET "/?Action=StartInstances&Version=2016-11-15&InstanceId.1=<id>"

/aws ec2 stop <instance-id> — Stop an instance

1. Confirm with user
2. aws-api.sh ec2 GET "/?Action=StopInstances&Version=2016-11-15&InstanceId.1=<id>"

/aws ec2 reboot <instance-id> — Reboot an instance

1. Confirm with user
2. aws-api.sh ec2 GET "/?Action=RebootInstances&Version=2016-11-15&InstanceId.1=<id>"

/aws ec2 terminate <instance-id> — Terminate (delete) an instance

1. Always confirm — irreversible
2. aws-api.sh ec2 GET "/?Action=TerminateInstances&Version=2016-11-15&InstanceId.1=<id>"

/aws ec2 volumes — List EBS volumes

1. aws-api.sh ec2 GET "/?Action=DescribeVolumes&Version=2016-11-15"
2. Display: Volume ID | Size GB | Type | State | AZ | Attached To

/aws ec2 snapshots — List EBS snapshots

1. aws-api.sh ec2 GET "/?Action=DescribeSnapshots&Version=2016-11-15&Owner.1=self"
2. Display: Snapshot ID | Volume ID | Size GB | State | Started | Description

/aws ec2 snapshot create <volume-id> [description] — Create snapshot

1. aws-api.sh ec2 GET "/?Action=CreateSnapshot&Version=2016-11-15&VolumeId=<id>&Description=<desc>"

/aws ec2 sg — List security groups

1. aws-api.sh ec2 GET "/?Action=DescribeSecurityGroups&Version=2016-11-15"
2. Display: SG ID | Name | VPC | Description | Inbound Rules | Outbound Rules

/aws ec2 sg info <sg-id> — Security group details with rules

1. aws-api.sh ec2 GET "/?Action=DescribeSecurityGroups&Version=2016-11-15&GroupId.1=<id>"
2. Display all inbound/outbound rules: Protocol | Port Range | Source/Dest | Description

/aws ec2 images — List owned AMIs

1. aws-api.sh ec2 GET "/?Action=DescribeImages&Version=2016-11-15&Owner.1=self"
2. Display: AMI ID | Name | State | Created | Description

2. S3 — Storage (/aws s3)

S3 uses a REST API. The service host is s3.${region}.amazonaws.com.

/aws s3 or /aws s3 buckets — List buckets

1. aws-api.sh s3 GET "/"
2. Parse XML: extract Bucket/Name and Bucket/CreationDate
3. Display table: Name | Created

/aws s3 ls <bucket> [prefix] — List objects

1. aws-api.sh s3 GET "/<bucket>?list-type=2&prefix=<prefix>&delimiter=/" Note: for S3, use path-style: service=s3, path=/<bucket>?... Or use virtual-hosted: adjust the host. Path-style is simpler for the helper.
2. Parse XML: CommonPrefixes/Prefix (dirs) and Contents (files)
3. Display: Name | Size | Last Modified | Storage Class

/aws s3 info <bucket> — Bucket details

1. Location: aws-api.sh s3 GET "/<bucket>?location"
2. Versioning: aws-api.sh s3 GET "/<bucket>?versioning"
3. Encryption: aws-api.sh s3 GET "/<bucket>?encryption"
4. Display: location, versioning status, encryption, lifecycle rules

/aws s3 create <bucket> — Create a bucket

1. Ask: name, region
2. Confirm before creating
3. aws-api.sh s3 PUT "/<bucket>" with <CreateBucketConfiguration><LocationConstraint>${region}</LocationConstraint></CreateBucketConfiguration>

/aws s3 delete <bucket> — Delete a bucket

1. Always confirm — bucket must be empty
2. aws-api.sh s3 DELETE "/<bucket>"

/aws s3 upload <bucket> <local_file> [key] — Upload object

1. Verify local file exists
2. Upload: aws-api.sh s3 PUT "/<bucket>/<key>" with file content For large files, note: this helper does simple PUT; multipart not supported

/aws s3 rm <bucket> <key> — Delete object

1. Confirm with user
2. aws-api.sh s3 DELETE "/<bucket>/<key>"

3. RDS — Databases (/aws rds)

RDS uses the Query API: GET /?Action=...&Version=2014-10-31

/aws rds or /aws rds list — List DB instances

1. aws-api.sh rds GET "/?Action=DescribeDBInstances&Version=2014-10-31"
2. Display: Identifier | Engine | Class | Status | Endpoint | Storage | AZ

/aws rds info <identifier> — Instance details

1. aws-api.sh rds GET "/?Action=DescribeDBInstances&Version=2014-10-31&DBInstanceIdentifier=<id>"
2. Display: full config, endpoint, port, storage, backup, maintenance, security groups

/aws rds clusters — List Aurora clusters

1. aws-api.sh rds GET "/?Action=DescribeDBClusters&Version=2014-10-31"
2. Display: Cluster ID | Engine | Status | Endpoint | Members

/aws rds snapshots [identifier] — List snapshots

1. aws-api.sh rds GET "/?Action=DescribeDBSnapshots&Version=2014-10-31" (optionally filter by DB)
2. Display: Snapshot ID | DB | Engine | Status | Created | Size GB

/aws rds snapshot create <identifier> <snapshot-name> — Create snapshot

1. Confirm with user
2. aws-api.sh rds GET "/?Action=CreateDBSnapshot&Version=2014-10-31&DBInstanceIdentifier=<id>&DBSnapshotIdentifier=<name>"

/aws rds reboot <identifier> — Reboot instance

1. Confirm with user
2. aws-api.sh rds GET "/?Action=RebootDBInstance&Version=2014-10-31&DBInstanceIdentifier=<id>"

4. Lambda — Serverless (/aws lambda)

Lambda uses a REST/JSON API.

/aws lambda or /aws lambda list — List functions

1. aws-api.sh lambda GET "/2015-03-31/functions"
2. Parse JSON: Functions[]
3. Display: Name | Runtime | Memory | Timeout | Last Modified | Description

/aws lambda info <name> — Function details

1. aws-api.sh lambda GET "/2015-03-31/functions/<name>"
2. Display: all config, handler, role, layers, env vars, VPC, dead letter

/aws lambda invoke <name> [payload] — Invoke a function

1. Confirm with user
2. aws-api.sh lambda POST "/2015-03-31/functions/<name>/invocations" '<payload>'
3. Show response payload and status

/aws lambda aliases <name> — List aliases

1. aws-api.sh lambda GET "/2015-03-31/functions/<name>/aliases"

/aws lambda versions <name> — List versions

1. aws-api.sh lambda GET "/2015-03-31/functions/<name>/versions"

/aws lambda concurrency <name> — Get concurrency config

1. aws-api.sh lambda GET "/2015-03-31/functions/<name>/concurrency"

5. Route 53 — DNS (/aws route53)

Route 53 is a global service (signed with us-east-1). REST/XML API.

/aws route53 or /aws route53 zones — List hosted zones

1. aws-api.sh route53 GET "/2013-04-01/hostedzone"
2. Display: Zone ID | Name | Type | Records | Comment

/aws route53 records <zone-id> — List record sets

1. aws-api.sh route53 GET "/2013-04-01/hostedzone/<zone-id>/rrset"
2. Display: Name | Type | TTL | Values

/aws route53 add <zone-id> — Add a record

1. Ask: name, type, TTL, values
2. Confirm before creating
3. aws-api.sh route53 POST "/2013-04-01/hostedzone/<zone-id>/rrset" with XML change batch:

   <?xml version="1.0"?>
   <ChangeResourceRecordSetsRequest xmlns="https://route53.amazonaws.com/doc/2013-04-01/">
     <ChangeBatch>
       <Changes>
         <Change>
           <Action>CREATE</Action>
           <ResourceRecordSet>
             <Name>...</Name><Type>...</Type><TTL>...</TTL>
             <ResourceRecords><ResourceRecord><Value>...</Value></ResourceRecord></ResourceRecords>
           </ResourceRecordSet>
         </Change>
       </Changes>
     </ChangeBatch>
   </ChangeResourceRecordSetsRequest>

   Note: for Route 53 POST, set Content-Type to application/xml instead of application/json.

/aws route53 delete <zone-id> — Delete a record

1. Always confirm with user
2. Same API as add, but with <Action>DELETE</Action>

/aws route53 modify <zone-id> — Modify a record

1. Use UPSERT action (creates or updates)

/aws route53 health — List health checks

1. aws-api.sh route53 GET "/2013-04-01/healthcheck"
2. Display: ID | Type | FQDN/IP | Port | Path | Status

6. CloudWatch — Monitoring (/aws cloudwatch)

CloudWatch uses the Query API: GET /?Action=...&Version=2010-08-01

/aws cloudwatch alarms — List alarms

1. aws-api.sh monitoring GET "/?Action=DescribeAlarms&Version=2010-08-01"
2. Display: Name | State | Metric | Threshold | Actions

/aws cloudwatch alarm info <name> — Alarm details

1. aws-api.sh monitoring GET "/?Action=DescribeAlarms&Version=2010-08-01&AlarmNames.member.1=<name>"

/aws cloudwatch metrics <namespace> — List metrics

1. aws-api.sh monitoring GET "/?Action=ListMetrics&Version=2010-08-01&Namespace=<ns>"
2. Common namespaces: AWS/EC2, AWS/RDS, AWS/Lambda, AWS/S3, AWS/ECS
3. Display: Metric Name | Namespace | Dimensions

/aws cloudwatch logs groups — List log groups

1. aws-api.sh logs GET "/" with body {"limit":50} and header X-Amz-Target: Logs_20140328.DescribeLogGroups Note: CloudWatch Logs uses JSON-RPC style. The service name for signing is logs.
2. Display: Name | Stored Bytes | Retention | Created

/aws cloudwatch logs streams <group> — List log streams

1. Service: logs, POST with X-Amz-Target: Logs_20140328.DescribeLogStreams and body {"logGroupName":"<group>","orderBy":"LastEventTime","descending":true,"limit":20}

/aws cloudwatch logs tail <group> [stream] — Get recent log events

1. Service: logs, POST with X-Amz-Target: Logs_20140328.GetLogEvents or FilterLogEvents

7. IAM — Identity (/aws iam)

IAM is a global service (signed with us-east-1). Query API: GET /?Action=...&Version=2010-05-08

/aws iam users — List IAM users

1. aws-api.sh iam GET "/?Action=ListUsers&Version=2010-05-08"
2. Display: Username | User ID | Created | Last Activity | ARN

/aws iam user <username> — User details

1. aws-api.sh iam GET "/?Action=GetUser&Version=2010-05-08&UserName=<name>"
2. Also list policies: /?Action=ListAttachedUserPolicies&Version=2010-05-08&UserName=<name>
3. And groups: /?Action=ListGroupsForUser&Version=2010-05-08&UserName=<name>

/aws iam roles — List IAM roles

1. aws-api.sh iam GET "/?Action=ListRoles&Version=2010-05-08"
2. Display: Role Name | Created | Description | ARN

/aws iam policies — List customer-managed policies

1. aws-api.sh iam GET "/?Action=ListPolicies&Version=2010-05-08&Scope=Local"
2. Display: Policy Name | ARN | Attached | Created

/aws iam groups — List groups

1. aws-api.sh iam GET "/?Action=ListGroups&Version=2010-05-08"
2. Display: Group Name | Created | ARN

/aws iam keys <username> — List access keys

1. aws-api.sh iam GET "/?Action=ListAccessKeys&Version=2010-05-08&UserName=<name>"
2. Display: Key ID | Status | Created (never show the secret key)

8. ECS — Containers (/aws ecs)

ECS uses JSON-RPC API. Service name: ecs. POST to / with X-Amz-Target header.

Note: For ECS calls, use a special invocation pattern:

${CLAUDE_SKILL_DIR}/aws-api.sh ecs POST "/" '{"cluster":"my-cluster"}'

And add the X-Amz-Target header. Since the helper doesn't support custom headers directly, use the alternative approach of calling the ECS Query API when available, or note this limitation.

/aws ecs or /aws ecs clusters — List clusters

1. aws-api.sh ecs POST "/" '{"maxResults":100}' — but this requires the X-Amz-Target: AmazonEC2ContainerServiceV20141113.ListClusters header
2. Alternative: document that ECS is best managed with a small Python wrapper or the AWS CLI
3. Display: Cluster ARN | Name

/aws ecs services <cluster> — List services

1. Requires X-Amz-Target: AmazonEC2ContainerServiceV20141113.ListServices
2. Body: {"cluster":"<cluster>"}

/aws ecs tasks <cluster> — List running tasks

1. ListTasks + DescribeTasks for details
2. Display: Task ID | Definition | Status | Started | Container

9. VPC — Networking (/aws vpc)

VPC is part of the EC2 API.

/aws vpc or /aws vpc list — List VPCs

1. aws-api.sh ec2 GET "/?Action=DescribeVpcs&Version=2016-11-15"
2. Display: VPC ID | CIDR | State | Default | Name Tag

/aws vpc subnets [vpc-id] — List subnets

1. aws-api.sh ec2 GET "/?Action=DescribeSubnets&Version=2016-11-15" (optionally filter)
2. Display: Subnet ID | VPC | CIDR | AZ | Available IPs | Name

/aws vpc sg — Alias for /aws ec2 sg

/aws vpc nat — List NAT gateways

1. aws-api.sh ec2 GET "/?Action=DescribeNatGateways&Version=2016-11-15"
2. Display: NAT ID | VPC | Subnet | State | Public IP

/aws vpc igw — List internet gateways

1. aws-api.sh ec2 GET "/?Action=DescribeInternetGateways&Version=2016-11-15"
2. Display: IGW ID | VPC | State

/aws vpc routes [rtb-id] — List route tables

1. aws-api.sh ec2 GET "/?Action=DescribeRouteTables&Version=2016-11-15"
2. Display: RTB ID | VPC | Routes (dest → target) | Associations

10. Billing (/aws billing)

/aws billing — Cost summary

1. Use Cost Explorer API (service: ce): aws-api.sh ce POST "/" '{"TimePeriod":{"Start":"<30-days-ago>","End":"<today>"},"Granularity":"MONTHLY","Metrics":["UnblendedCost"]}' With header X-Amz-Target: AWSInsightsIndexService.GetCostAndUsage
2. Display: Period | Cost | Currency

Note: Cost Explorer has similar JSON-RPC limitations as ECS. If the helper doesn't support custom targets natively, construct the dates and body, then explain how to read billing in the AWS Console as fallback.

/aws billing services — Cost breakdown by service

1. Add GroupBy: [{"Type":"DIMENSION","Key":"SERVICE"}] to the request
2. Display: Service | Cost | % of Total

Important rules

• Always confirm before destructive actions: terminate instance, delete bucket/snapshot, remove DNS record
• Always confirm before billable actions: launch instance, create RDS, create NAT gateway
• Source the config before building commands: source ${CLAUDE_SKILL_DIR}/aws.conf
• URL-encode query parameters properly (spaces as %20, not +)
• XML responses: strip namespaces for easier parsing, use the helper pattern shown above
• JSON responses: check for errorMessage or Error fields
• If a call returns 403 AccessDenied, explain which IAM policy is needed
• If no arguments given to /aws, show a summary of available commands
• Display sizes in human-readable format (GB/TB)
• Display costs in USD with 2 decimal places
• For large lists, check for NextToken / Marker / IsTruncated and handle pagination
• Service names for signing: ec2, s3, rds, lambda, route53, monitoring, logs, iam, ecs, ce
• Global services (iam, sts, route53, cloudfront): signed with us-east-1 regardless of config region
• S3 note: the helper uses path-style URLs (s3.region.amazonaws.com/bucket). Virtual-hosted style may be needed for some operations.
• ECS/CloudWatch Logs/Cost Explorer: these use JSON-RPC (X-Amz-Target header). The helper may not support this natively — use curl directly with the signed headers when needed, or suggest the AWS CLI for these specific services.

Quick reference — API patterns

# EC2 (Query API)
ec2 GET "/?Action=DescribeInstances&Version=2016-11-15"
ec2 GET "/?Action=StartInstances&Version=2016-11-15&InstanceId.1=i-xxx"
ec2 GET "/?Action=DescribeSecurityGroups&Version=2016-11-15"
ec2 GET "/?Action=DescribeVolumes&Version=2016-11-15"
ec2 GET "/?Action=DescribeVpcs&Version=2016-11-15"
ec2 GET "/?Action=DescribeSubnets&Version=2016-11-15"

# S3 (REST)
s3 GET "/"                                          # List buckets
s3 GET "/<bucket>?list-type=2&prefix=&delimiter=/"  # List objects
s3 PUT "/<bucket>"                                  # Create bucket
s3 DELETE "/<bucket>/<key>"                          # Delete object

# RDS (Query API)
rds GET "/?Action=DescribeDBInstances&Version=2014-10-31"
rds GET "/?Action=DescribeDBSnapshots&Version=2014-10-31"

# Lambda (REST/JSON)
lambda GET "/2015-03-31/functions"                  # List functions
lambda GET "/2015-03-31/functions/<name>"            # Function info
lambda POST "/2015-03-31/functions/<name>/invocations" '{"key":"val"}'

# Route 53 (REST/XML, global)
route53 GET "/2013-04-01/hostedzone"                # List zones
route53 GET "/2013-04-01/hostedzone/<id>/rrset"     # List records
route53 POST "/2013-04-01/hostedzone/<id>/rrset"    # Change records (XML body)

# CloudWatch (Query API, service name: monitoring)
monitoring GET "/?Action=DescribeAlarms&Version=2010-08-01"
monitoring GET "/?Action=ListMetrics&Version=2010-08-01&Namespace=AWS/EC2"

# IAM (Query API, global)
iam GET "/?Action=ListUsers&Version=2010-05-08"
iam GET "/?Action=ListRoles&Version=2010-05-08"

# CloudWatch Logs (JSON-RPC, service name: logs)
# Requires X-Amz-Target header — see ECS/Logs note in rules