aws-cli-beast

What this skill does

# AWS CLI Beast Mode

## Overview

Advanced AWS CLI patterns for speed, precision, and security-first automation. Covers JMESPath queries, bulk operations, waiters, cross-account access, and destructive operation safety.

## When to Use

- Bulk operations across thousands of AWS resources
- Advanced JMESPath filtering and output transformation
- Automated scripts for AWS routines
- Multi-profile and multi-region management
- Security auditing and compliance checks
- CLI-driven infrastructure-as-code workflows

## Instructions

### Step 1: Categorize the Request

| Category | Services | Commands |
|----------|----------|----------|
| Compute | EC2, Lambda | describe-instances, invoke, publish-version |
| Storage | S3 | sync, cp, mb, rb, presign |
| Database | DynamoDB, RDS | query, scan, batch-write-item |
| Networking | VPC, Route53 | describe-vpcs, describe-security-groups |
| Security | IAM | simulate-principal-policy, get-policy-version |
| Observability | CloudWatch | get-metric-statistics, filter-log-events |

### Step 2: Apply Beast Mode Principles

1. **Dry-run first**: Always validate with `--dryrun` or `--dry-run`
2. **Query server-side**: Use `--query` with JMESPath to filter before transfer
3. **Batch intelligently**: Paginate with `--max-results` and parallelize with xargs
4. **Wait properly**: Use built-in waiters or exponential backoff polling
5. **Switch contexts**: Use `--profile` and `--region` for multi-account operations

### Step 3: Validate Destructive Operations

**MANDATORY** for any destructive operation:

```bash
# S3 sync with delete - MUST dry-run first
aws s3 sync s3://source/ s3://dest/ --delete --dryrun
# Review output, then remove --dryrun only if satisfied

# Bulk EC2 stop - validate targets first
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=development" \
  --query 'Reservations[].Instances[?State.Name==`running`].InstanceId' \
  --output text
# Confirm list, then pipe to stop command

# IAM policy attachment - simulate first
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/myuser \
  --action-names s3:DeleteObject \
  --resource-arns arn:aws:s3:::my-bucket/*
```

### Step 4: Reference Detailed Guides

- `compute-mastery.md` - EC2, Lambda, Spot Fleets, ASG
- `data-ops-beast.md` - S3 multipart, DynamoDB batch, RDS snapshots
- `networking-security-hardened.md` - VPC Flow Logs, IAM policies, security groups
- `automation-patterns.md` - Shell aliases, JMESPath templates, CI/CD integration

## Examples

### Example 1: Bulk EC2 Stop

**"Stop all development instances"**

```bash
# 1. Dry-run: identify targets
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=development" \
           "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].InstanceId' \
  --output text

# 2. Confirm IDs, then execute
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=development" \
           "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].InstanceId' \
  --output text | xargs aws ec2 stop-instances --instance-ids
```

### Example 2: S3 Migration with Encryption

**"Migrate data between buckets with SSE"**

```bash
# 1. Dry-run migration
aws s3 sync s3://source-bucket/ s3://dest-bucket/ \
  --sse AES256 \
  --storage-class GLACIER \
  --exclude "*.tmp" \
  --dryrun

# 2. Enable versioning on destination
aws s3api put-bucket-versioning \
  --bucket dest-bucket \
  --versioning-configuration Status=Enabled

# 3. Execute after review
aws s3 sync s3://source-bucket/ s3://dest-bucket/ \
  --sse AES256 \
  --storage-class GLACIER \
  --exclude "*.tmp"
```

### Example 3: IAM Security Audit

**"Find overprivileged IAM users"**

```bash
aws iam list-users --query 'Users[].UserName' --output text | \
while read user; do
  echo "Checking $user..."
  aws iam simulate-principal-policy \
    --policy-source-arn "arn:aws:iam::123456789012:user/$user" \
    --action-names DeleteItem,DeleteTable,DeleteFunction \
    --resource-arns "*" \
    --query 'EvaluationResults[?EvalDecision==`allowed`]'
done
```

### Example 4: Multi-Region Lambda Deployment

**"Deploy Lambda to all regions"**

```bash
for region in us-east-1 us-west-2 eu-west-1; do
  echo "Deploying to $region..."
  aws lambda update-function-code \
    --function-name my-function \
    --zip-file fileb://function.zip \
    --region $region \
    --publish
  aws lambda wait function-active \
    --function-name my-function \
    --region $region
done
```

### Example 5: JMESPath Advanced Filtering

**"Get running instances with specific tags as table"**

```bash
aws ec2 describe-instances \
  --query 'Reservations[].Instances[?State.Name==`running`].[InstanceId,Tags[?Key==`Name`].Value[0]|[0],PrivateIpAddress]' \
  --output table
```

## Best Practices

1. Use `--output json` for programmatic processing
2. Filter with JMESPath server-side before transfer
3. Implement retry logic with exponential backoff
4. Use waiters instead of manual polling loops
5. Tag all resources for cost allocation and automation
6. Separate dev/staging/prod with AWS profiles
7. Enable CloudTrail for audit compliance
8. Validate IAM policies with simulate-principal-policy before attachment
9. Use --dry-run on every state-modifying operation
10. Enable MFA for security-sensitive operations

## Constraints and Warnings

### Rate Limiting
- AWS API throttling applies; use `--max-throttle` and exponential backoff
- Check `aws service-quotas` for current limits

### Pagination
- Default page size is variable; use `--max-results` for consistency
- Use `--no-paginate` with jq for full dataset processing

### Destructive Operations
- **S3 sync --delete**: Irreversibly removes files not in source
- **EC2 terminate-instances**: Cannot be undone; validate instance IDs first
- **IAM detach/policy**: May break existing access; simulate before applying
- **RDS delete-db-instance**: Snapshots do not protect all scenarios; verify retention

### Security
- Never commit AWS credentials; use `aws configure` or environment variables
- Rotate access keys regularly with `aws iam create-access-key`
- Use least-privilege: simulate before granting permissions