Check the AWS profile, region, account ID, and caller identity before starting AWS work. Read local configuration and validate credentials, then flag missing settings, expired access, or possible IAM restrictions associated with SSO authentication.
Discover the user's local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task. Use this skill before any other AWS work — deploying to SageMaker, creating resources, calling AWS APIs, or anything that touches an AWS account. Use it especially when the user has not specified a region or profile explicitly, when they say things like "use my AWS account", "deploy to AWS", "use my profile", or when about to make any AWS CLI or SDK call. Never guess the region or account ID — always use this skill to read it from the local configuration first.
Review the instructions the agent will receive before you install.
Before doing any AWS work, read the user's local AWS config. Don't guess the region, and don't ask the user for things their config already answers.
Run these at the start of the AWS work and remember the results for the rest of the session.
AWS_PROFILE env var, else default. If the user mentioned a profile in their prompt, that overrides. If the named profile doesn't exist in ~/.aws/config, surface that clearly.
Resolution order — stop at the first one that produces a value:
AWS_REGION env varAWS_DEFAULT_REGION env varregion field on the active profile in ~/.aws/configDo not fall back to us-east-1 or any other hardcoded default.
aws sts get-caller-identity --profile <profile> --region <region>
Three purposes in one call: confirms credentials are valid (stop if not), returns the Account ID (needed for ARN construction), returns the Arn of the caller.
The Arn field tells you what kind of principal this is. The pattern matters because it determines what IAM operations the caller can do.
| ARN pattern | Type | IAM write capability |
|---|---|---|
arn:aws:iam::<acct>:user/<name> | IAM user | Depends on attached policies |
arn:aws:sts::<acct>:assumed-role/AWSReservedSSO_<...>/<email> | SSO assumed-role | Typically none — can't create/modify IAM roles |
arn:aws:sts::<acct>:assumed-role/<role>/<session> | Regular assumed-role | Depends on the role |
If the caller is SSO, surface this immediately before later skills hit iam:CreateRole and fail:
Heads up: you're authenticated via SSO (
AWSReservedSSO_<PermissionSet>_...). SSO principals usually can't create IAM roles directly. If we need a SageMaker execution role, I'll look for an existing one first — if none exists, you'll need to ask whoever manages your AWS access to create one.
This is the highest-leverage thing this skill does. Surfacing it now turns a confusing mid-deployment error into a five-second conversation.
# Effective profile and region (faster than parsing config files)
aws configure list
# Validate credentials and get identity
aws sts get-caller-identity
aws sts get-caller-identity --profile <profile-name> # if a profile was named
aws configure list handles env-var overrides and shows the resolved effective values. Prefer it over parsing ~/.aws/config yourself. If you need to read raw config (e.g. to list profiles), ~/.aws/config and ~/.aws/credentials are plain INI files — read-only.
One or two lines, not a wall of text:
Working with profile
my-profileineu-west-1, account123456789012. You're authenticated via SSO, so we'll need to use an existing IAM role rather than create one.
Don't ask the user to confirm the region you just read from their config — they configured it; that is the confirmation.
If something is wrong (credentials expired, profile doesn't exist, no region anywhere), stop and surface the specific error before continuing.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Manage Hugging Face Hub through the hf command line tool. Download and upload models or datasets, organize cloud storage, manage authentication and local caches, run scheduled jobs, and deploy or maintain model inference services.
Prepare an isolated Python environment for SageMaker deployments and AWS automation. The skill selects a supported Python version, installs current AWS packages, and checks versions so installation and execution use the same environment.
Plan how to serve a model on Amazon SageMaker AI. The skill uses model type, traffic, response time, and cost constraints to recommend a deployment route, check instance quotas, and coordinate specialized setup and deployment skills.
Prepare SageMaker deployments and training by finding existing execution roles, checking trust settings, and reviewing required permissions. Guides role creation only when necessary and identifies permission issues that require an AWS administrator.
Deploy SageMaker endpoints, the services that answer model requests, with automatic capacity scaling, CloudWatch alarms, and resource tags. Supports real-time and asynchronous inference, scaling down to zero instances, deployment checks, and resource cleanup.
Choose a serving container for models deployed on SageMaker. Match the model type to a compatible image, retrieve its address from the AWS catalog, and check regional availability, CPU or GPU variants, and required host settings.