aws-scan-resources

name	aws-scan-resources
description	Enumerate AWS compute, storage, network, and IAM resources and write a structured inventory to AWS_STATE_DIR.
model	sonnet
effort	medium
context	fork

Procedure

ASR-1. Verify: aws CLI, AWS_PROFILE, AWS_STATE_DIR. ASR-2. Enumerate with read-only CLI (pass --profile $AWS_PROFILE --region $AWS_DEFAULT_REGION on every call):

• EC2: aws ec2 describe-instances --query 'Reservations[].Instances[].{id:InstanceId,state:State.Name,type:InstanceType}'
• ECS: aws ecs list-clusters + aws ecs list-services --cluster <name>
• Lambda: aws lambda list-functions --query 'Functions[].{name:FunctionName,runtime:Runtime}'
• S3: aws s3api list-buckets --query 'Buckets[].Name'
• EBS: aws ec2 describe-volumes --query 'Volumes[].{id:VolumeId,size:Size,state:State}'
• RDS: aws rds describe-db-instances --query 'DBInstances[].{id:DBInstanceIdentifier,engine:Engine}'
• VPC/SG: aws ec2 describe-vpcs, aws ec2 describe-security-groups
• IAM: aws iam list-users, aws iam list-roles, aws iam list-policies --scope Local ASR-3. Write raw data to $AWS_STATE_DIR/resources-<YYYYMMDD>.json. Single-region scope. ASR-4. Write human-readable summary to $AWS_STATE_DIR/resources-<YYYYMMDD>.md:
• Header: profile, region, scan timestamp
• Table: resource type | count | notes (e.g. running/stopped for EC2)
• No ARNs, IDs, or IP addresses. ASR-5. Print to conversation: resource type → count only (no ARNs, IDs, IPs).

Rules

• Read-only: list-, describe-, get-* only.
• Identifiers must NOT appear in conversation.
• Use --no-paginate; fall back to --max-items 1000 where needed.
• Skip on AccessDeniedException — log to state file, continue.

Skip Conditions

Skip if $AWS_STATE_DIR/resources-<YYYYMMDD>.json exists and is less than 4 hours old.