aws-resource-querylisted

# AWS Resource Query ## Purpose and absolute safety contract Answer questions about currently existing AWS resources by translating intent into bounded, read-only AWS CLI commands. This Skill never creates, modifies, deletes, starts, stops, reboots, terminates, attaches, detaches, publishes, invokes, sends, or executes AWS resources or data. It is for discovery and evidence gathering; use a separate authorized workflow for changes. Allowed command families are limited to `describe-*`, `list-*`, `get-*`, `sts get-caller-identity`, `aws configure get`, `resourcegroupstaggingapi get-resources`, `ce get-*`, and explicitly approved read-only support queries. If a request implies a write, explain the read-only boundary and offer to show current state or produce a separate change plan without executing it. Do not expose access keys, session tokens, secret values, private endpoints, customer data, or full policy documents when a redacted summary answers the question. Treat command output as sensitive until its data class and audience are known. ## Step 1: parse and constrain intent Extract: - target account/profile and region (or explicitly all regions); - service, resource type, identifier, tags, state, owner, environment, and time range; - requested detail, output audience, and whether counts, a table, or raw JSON is needed; - authorization and data-sensitivity limits. If account, region, resource scope, or requested detail is ambiguous, query the safest narrow scope first