aws

# AWS Use the installed `aws` CLI for AWS inspection, diagnosis, and explicitly authorized changes. ## Route the request - For `reset-password` or `--reset-password`, read [references/reset-password.md](references/reset-password.md) completely and use the `vd:gopass` skill. - For other requests, follow the general workflow below and load service-specific official documentation only when command behavior is unclear or likely to have changed. ## General workflow 1. Confirm the active identity before interpreting or changing anything: ```bash aws sts get-caller-identity --output json aws configure list ``` 2. Resolve the intended account, profile, region, service, and exact resource. Use `--profile` and `--region` explicitly when local defaults do not prove the intended scope. 3. Inspect current state with `list-*`, `get-*`, `describe-*`, CloudTrail, or the relevant service API before forming a diagnosis. 4. For authorization failures, trace the failed CloudTrail event and evaluate every applicable policy layer. Do not infer the denying layer from attached policies alone. 5. Keep investigations read-only unless the user requested a change. Before a write, restate the exact account, resource, action, and expected effect when any are ambiguous. 6. Perform the smallest authorized AWS API change. Do not broaden a repair into unrelated IAM, Organizations, networking, or production mutations. 7. Verify with fresh service state and, when useful, the resulting CloudTr...