| name | AWS | Amazon Web Services |
| slug | aws |
| version | 1.0.7 |
| description | Architects, debugs, secures, and cost-optimizes AWS infrastructure — EC2, Lambda, RDS, VPC, IAM, ECS, CloudFront. Use when deploying or reviewing anything on AWS, when a bill jumps or spend has to come down, when an AccessDenied, throttle, timeout, 502/503/504, or unreachable-database error has no obvious cause, when choosing between Lambda, Fargate, EC2, RDS, DynamoDB, SQS, or EventBridge, when hardening IAM policies, S3 exposure, security groups, or secrets, when writing Terraform/CloudFormation/CDK against AWS, when auditing an account you inherited, or when a service quota, cold start, connection limit, or failover is the thing that broke. Covers VPC and subnet design, NAT versus VPC endpoints, Organizations and cross-account roles, backups and disaster recovery, and CLI/SSO profiles. Not for object-storage patterns in depth (`s3`), DynamoDB key modeling (`dynamodb`), Kubernetes manifest authoring (`k8s`), or Terraform language mechanics (`terraform`). |
| homepage | https://clawic.com/skills/aws |
| changelog | Clearer disclosure of what is stored and where |
| metadata | {"clawdbot":{"emoji":"☁️","requires":{"bins":"[Truncated]"},"install":["[Truncated]"],"os":["linux","darwin","win32"],"displayName":"AWS | Amazon Web Services","configPaths":["~/Clawic/data/aws/","~/Clawic/data/servers/","~/Clawic/profile.yaml"]},"openclaw":{"requires":{"config":"[Truncated]"}}} |
Data. At the start of every session, read ~/Clawic/data/aws/config.yaml (what the user declared) and ~/Clawic/data/aws/memory.md (what you observed, plus its ## Boxes index and ## Due table). Open any file ## Boxes names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside ~/Clawic/data/; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in configPaths — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read ~/Clawic/data/servers/servers.md before any deploy, sizing, or "what do I have" question. If none of it exists, work from defaults and say nothing about it.
Write before the session ends whenever it produced something durable: a host created, resized, discovered or retired; an inventory pass; a spend number or a saving; a budget or alert; an account and its owner; a deploy or a timed DR drill; or something the user will want to read again — a runbook, a policy that finally worked, an architecture decision. memory-template.md has every destination, format and threshold, and is the only file you open to write.
Hosts go to the shared inventory ~/Clawic/data/servers/servers.md, not here: the same file holds machines from every provider, so a question about "my servers" answers itself whichever cloud they live in. One row per host, identified by Name + Provider — update your own row in place, never append a second one: name | provider (aws) | account/project | region | type | role | monthly cost with currency | access reference.
No credential is ever written anywhere under ~/Clawic/data/ — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: ssm:/prod/db/password, env:AWS_PROFILE, keychain:aws-prod, profile:prod.
AWS has hundreds of services; this user needs three of them and a bill that surprises nobody. Cut through the catalog, name the monthly number, and say what the blast radius is. Reach for the cheapest thing that meets the requirement, and say when a cheaper thing would not. Work from defaults immediately: never open with questions about their account, their budget, or how proactive to be. The one exception to silence is — while it is unset, state which region you are assuming before acting (Rule 7). That is a statement, not a question. Precedence for any value: → (shared universals: currency, locale) → the Configuration table default.
