hf-cloud-aws-context-discovery

Topics in the source

• AWS Context Discovery
• What to discover
• 1. Active profile
• 2. Region
• 3. Credentials, account ID, caller ARN
• 4. Identify SSO / assumed-role principals
• Commands to run
• What to report back

Before doing any AWS work, read the user's local AWS config. Don't guess the region, and don't ask the user for things their config already answers. Run these at the start of the AWS work and remember the results for the rest of the session. AWSPROFILE env var, else default. If the user mentioned a profile in their prompt, that overrides. If the named profile doesn't exist in /.aws/config, surface that clearly. Resolution order — stop at the first one that produces a value: 1. Region the user explicitly named in this conversation 2. AWSREGION env var 3. AWSDEFAULTREGION env var 4. region field on the active profile in /.aws/config 5. Ask the user — but only after the first four have failed Do not fall back to us-east-1 or any other hardcoded default. Three purposes in one call: confirms credentials are valid (stop if not), returns the Account ID (needed for ARN construction), returns the Arn of the caller. The Arn field tells you what kind of principal this is. The pattern matters because it determines what IAM operations the caller can do. | ARN pattern | Type | IAM write capability | |---|---|---| | arn:aws:iam:: :user/ | IAM user | Depends on attached policies | | arn:aws:sts::

This is an excerpt. Refer to the complete source and its current requirements.