Manage AWS resources across multiple accounts via the CLI with credential refresh and safety confirmations.
npx skills add https://github.com/timi-ty/agent-forge --skill aws-timi-ty
Please help me install this Agent Skill. Skill: aws Source: https://github.com/timi-ty/agent-forge/tree/main/skills/aws Command: npx skills add https://github.com/timi-ty/agent-forge --skill aws-timi-ty
~/.aws/account-registry.json with safe switching between static keys, IAM Identity Center, and saml2aws SAML SSO profiles. - Automatic Credential Refresh: Detects expired tokens (ExpiredTokenException, RequestExpired) and re-authenticates using the account's original auth method, then retries the failed command. - Safety Rails: Requires explicit confirmation before destructive operations (terminate, delete, purge) and warns about cost-incurring resources with the affected account name and ID. - Use Case: You ask to list running EC2 instances, but your SSO session expired overnight. The Skill detects the failure, runs aws sso login, verifies identity with sts get-caller-identity, and retries the query against the correct account. ## Quick Start Ask the agent to list all running EC2 instances in your active AWS account and show them in a table.High-intent search queries and answers about installing and using this skill.
Maintain an account registry at ~/.aws/account-registry.json that maps friendly names to AWS profiles, regions, and auth methods. Prefix every command with AWS_PROFILE=<profile> and verify the active account with aws sts get-caller-identity before operating.
Test the target account's credentials with sts get-caller-identity, refresh them if expired using its auth method (sso login, saml2aws login, or aws configure), then update the active field in the registry. Confirm the switch by re-running get-caller-identity.
ExpiredTokenException means your temporary credentials from SSO or SAML have expired. Re-authenticate using the original method, such as aws sso login --use-device-code or saml2aws login, verify with sts get-caller-identity, then retry the failed command.
Yes, use saml2aws with the Browser provider, which opens a Chromium window for login and MFA completion. Programmatic providers like KeyCloak or Okta cannot handle MFA flows, so the Browser provider is required.
Always display the active account name and ID before destructive operations like terminate-instances or delete-stack, and require explicit user confirmation. Warn the user when the request seems to target a different account than the active one.
selrai-companyInstall and configure the AWS CLI with access-key or SSO authentication.
MassimilianoPiliAutomate ECS deployments via GitHub Actions and CloudFormation.
hoodiniAutomate AWS account, organization, IAM, and billing management.
seb1nDefine, deploy, and manage cloud infrastructure with Terraform, Pulumi, CloudFormation, and AWS CDK.