AWS

List CloudFormation stacks. Args: - statusFilter: Filter by stack status (optional) Common status values: CREATE_COMPLETE, UPDATE_COMPLETE, DELETE_IN_PROGRESS, ROLLBACK_COMPLETE Returns stack summaries.

Get details of a CloudFormation stack. Args: - stackName: Stack name or ID (required) Returns stack configuration, parameters, outputs, and tags.

Get the template body of a CloudFormation stack. Args: - stackName: Stack name or ID (required) Returns the template in YAML or JSON format.

List resources in a CloudFormation stack. Args: - stackName: Stack name or ID (required) Returns logical and physical resource IDs, types, and status.

Get events for a CloudFormation stack. Args: - stackName: Stack name or ID (required) Returns stack events including status changes and error messages.

Create a new CloudFormation stack. Args: - stackName: Name for the stack (required) - templateBody: Template content (required if no templateUrl) - templateUrl: S3 URL for template (required if no templateBody) - parameters: Stack parameters (optional) - capabilities: Required capabilities like CAPABILITY_IAM (optional) - tags: Stack tags (optional) Returns the stack ID.

Add or update tags on a CloudFront resource. Args: - resourceArn: The CloudFront resource ARN (required) - tags: Array of tags to add (required) Returns confirmation.

Update an existing CloudFormation stack. Args: - stackName: Stack name or ID (required) - templateBody: New template content (optional) - templateUrl: S3 URL for new template (optional) - parameters: Updated parameters (optional) - capabilities: Required capabilities (optional) Returns the stack ID.

Delete a CloudFormation stack. Args: - stackName: Stack name or ID (required) WARNING: This will delete all resources created by the stack. Returns confirmation.

List change sets for a CloudFormation stack. Args: - stackName: Stack name or ID (required) Returns change set summaries.

Get details of a CloudFormation change set. Args: - stackName: Stack name or ID (required) - changeSetName: Change set name or ID (required) Returns change set details including resource changes.

Create a change set for a CloudFormation stack. Args: - stackName: Stack name or ID (required) - changeSetName: Name for the change set (required) - templateBody: Template content (optional) - templateUrl: S3 URL for template (optional) - parameters: Stack parameters (optional) - capabilities: Required capabilities (optional) - changeSetType: 'CREATE' for new stack, 'UPDATE' for existing (optional) Returns the change set ID.

Execute a CloudFormation change set. Args: - stackName: Stack name or ID (required) - changeSetName: Change set name or ID (required) This applies the changes in the change set to the stack. Returns confirmation.

Delete a CloudFormation change set. Args: - stackName: Stack name or ID (required) - changeSetName: Change set name or ID (required) Returns confirmation.

Validate a CloudFormation template. Args: - templateBody: Template content (required if no templateUrl) - templateUrl: S3 URL for template (required if no templateBody) Returns template parameters, description, and required capabilities.

List all CloudFront distributions. Returns distributions with IDs, domains, and status.

Get details of a CloudFront distribution. Args: - id: The distribution ID (required) Returns distribution configuration including origins and behaviors.

List tags on a DynamoDB resource. Args: - resourceArn: The DynamoDB resource ARN (required) Returns the resource tags.

Create a cache invalidation for a CloudFront distribution. Args: - distributionId: The distribution ID (required) - paths: Array of paths to invalidate (required, e.g., ['/*'] or ['/images/*', '/index.html']) - callerReference: Unique identifier for this request (optional, auto-generated if not provided) Returns the invalidation details including ID and status.

List cache invalidations for a CloudFront distribution. Args: - distributionId: The distribution ID (required) Returns list of invalidations with IDs and status.

Get details of a CloudFront cache invalidation. Args: - distributionId: The distribution ID (required) - invalidationId: The invalidation ID (required) Returns invalidation details including paths and status.

List tags on a CloudFront resource. Args: - resourceArn: The CloudFront resource ARN (required) Returns the resource tags.

Remove tags from a CloudFront resource. Args: - resourceArn: The CloudFront resource ARN (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation.

List available CloudWatch metrics. Args: - namespace: Filter by namespace (e.g., 'AWS/EC2', 'AWS/Lambda') Returns metrics with their namespaces, names, and dimensions.

Get statistics for a CloudWatch metric. Args: - namespace: The metric namespace (required, e.g., 'AWS/EC2') - metricName: The metric name (required, e.g., 'CPUUtilization') - dimensions: Array of {name, value} pairs for filtering - startTime: Start time in ISO 8601 format (required) - endTime: End time in ISO 8601 format (required) - period: The granularity in seconds (required, e.g., 300 for 5 minutes) - statistics: Array of statistics to retrieve (e.g., ['Average', 'Maximum']) Returns datapoints with timestamps and requested statistics.

List CloudWatch alarms. Args: - alarmNames: Optional array of alarm names to filter by Returns alarms with their states, metrics, and thresholds.

Temporarily set the state of a CloudWatch alarm. This is useful for testing alarm actions. Args: - alarmName: The alarm name (required) - stateValue: The state to set ('OK', 'ALARM', 'INSUFFICIENT_DATA') - stateReason: The reason for the state change (required) Returns confirmation of the state change.

Publish custom metrics to CloudWatch. Args: - namespace: The metric namespace (required, e.g., 'MyApp/Metrics') - metricData: Array of metrics to publish Each metric requires: - metricName: The metric name - value: The metric value (optional) - unit: The unit (optional, e.g., 'Count', 'Seconds', 'Bytes') - dimensions: Optional array of {name, value} pairs Returns confirmation of the publish operation.

List CloudWatch Log Groups. Args: - prefix: Filter by log group name prefix Returns log groups with stored bytes and retention settings.

List log streams in a CloudWatch Log Group. Args: - logGroupName: The log group name (required) Returns log streams ordered by last event time.

Get log events from a CloudWatch Log Stream. Args: - logGroupName: The log group name (required) - logStreamName: The log stream name (required) - startTime: Start time in milliseconds since epoch - endTime: End time in milliseconds since epoch - limit: Maximum number of events to return (default: 100) Returns log events with timestamps and messages.

Search and filter log events across multiple log streams. Args: - logGroupName: The log group name (required) - filterPattern: CloudWatch Logs filter pattern (e.g., 'ERROR', '"exception"') - startTime: Start time in milliseconds since epoch - endTime: End time in milliseconds since epoch - limit: Maximum number of events to return (default: 100) - logStreamNames: Filter to specific log streams (optional) Returns matching log events with stream names and timestamps.

Get details of a DynamoDB global table. Args: - globalTableName: The global table name (required) Returns global table configuration and replication info.

Add tags to a DynamoDB resource. Args: - resourceArn: The DynamoDB resource ARN (required) - tags: Array of tags to add (required) Returns confirmation.

Create or update a CloudWatch metric alarm. Args: - alarmName: The alarm name (required) - namespace: The metric namespace (required) - metricName: The metric name (required) - statistic: The statistic (Average, Sum, Minimum, Maximum, SampleCount) - period: The period in seconds (required) - evaluationPeriods: Number of periods to evaluate (required) - threshold: The threshold value (required) - comparisonOperator: Comparison operator (required) - dimensions: Optional metric dimensions - alarmDescription: Optional description - alarmActions: SNS topic ARNs to notify on ALARM - okActions: SNS topic ARNs to notify on OK - treatMissingData: How to treat missing data (missing, ignore, breaching, notBreaching) Returns confirmation of alarm creation.

Delete CloudWatch alarms. Args: - alarmNames: Array of alarm names to delete (required) WARNING: This action cannot be undone. Returns confirmation of deletion.

Enable actions for CloudWatch alarms. Args: - alarmNames: Array of alarm names (required) Returns confirmation of action enablement.

Disable actions for CloudWatch alarms. Useful for maintenance windows or to temporarily stop notifications. Args: - alarmNames: Array of alarm names (required) Returns confirmation of action disablement.

Create a new CloudWatch Log Group. Args: - logGroupName: The log group name (required) - tags: Optional tags as key-value pairs Returns confirmation of creation.

Delete a CloudWatch Log Group. WARNING: This action permanently deletes the log group and all its log streams. Args: - logGroupName: The log group name (required) Returns confirmation of deletion.

Describe auto scaling settings for a DynamoDB table replicas. Args: - tableName: The table name (required) Returns replica auto scaling configuration.

Set the retention policy for a CloudWatch Log Group. Args: - logGroupName: The log group name (required) - retentionInDays: Retention period in days (required) Valid retention values: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653 Returns confirmation of policy update.

Remove the retention policy from a CloudWatch Log Group. This causes logs to be retained indefinitely. Args: - logGroupName: The log group name (required) Returns confirmation of policy removal.

Create a new log stream in a CloudWatch Log Group. Args: - logGroupName: The log group name (required) - logStreamName: The log stream name (required) Returns confirmation of stream creation.

Delete a log stream from a CloudWatch Log Group. Args: - logGroupName: The log group name (required) - logStreamName: The log stream name (required) WARNING: This permanently deletes all log events in the stream. Returns confirmation of stream deletion.

Write log events to a CloudWatch Log Stream. Args: - logGroupName: The log group name (required) - logStreamName: The log stream name (required) - logEvents: Array of log events with timestamp and message (required) - sequenceToken: Sequence token for ordering (optional, not needed for new streams) Each log event requires: - timestamp: Unix timestamp in milliseconds - message: The log message Returns the next sequence token for subsequent writes.

List all DynamoDB tables in the region. Returns table names. Use describe_table for details.

Get detailed information about a DynamoDB table. Args: - tableName: The table name (required) Returns table schema, billing mode, and throughput configuration.

List Elastic IP addresses. Args: - allocationIds: Array of allocation IDs to filter by Returns list of Elastic IPs with associations and instance info.

Query items from a DynamoDB table using key conditions. Args: - tableName: The table name (required) - keyConditionExpression: Key condition (e.g., 'PK = :pk') - expressionAttributeValues: Values for placeholders (e.g., {':pk': {'S': 'user#123'}}) - expressionAttributeNames: Name substitutions for reserved words - filterExpression: Additional filter to apply after query - indexName: Name of GSI or LSI to query - limit: Maximum items to return - scanIndexForward: true for ascending, false for descending Returns matching items.

Scan all items in a DynamoDB table (expensive operation). Use Query when possible. Scan reads every item in the table. Args: - tableName: The table name (required) - filterExpression: Filter to apply (e.g., 'status = :s') - expressionAttributeValues: Values for placeholders - expressionAttributeNames: Name substitutions - indexName: Secondary index to scan - limit: Maximum items to return Returns matching items.

Describe DynamoDB account limits for capacity units. Returns account and table capacity limits.

Get a single item from DynamoDB by its primary key. Args: - tableName: The table name (required) - key: The primary key (e.g., {'PK': {'S': 'user#123'}, 'SK': {'S': 'profile'}}) - consistentRead: Use strongly consistent read (default: false) - projectionExpression: Attributes to retrieve Returns the item or null if not found.

Put an item into a DynamoDB table. Args: - tableName: The table name (required) - item: The item to put (must include primary key attributes) - conditionExpression: Condition for the put (e.g., 'attribute_not_exists(PK)') - expressionAttributeValues: Values for condition placeholders - expressionAttributeNames: Name substitutions Returns confirmation of the put operation.

Delete an item from a DynamoDB table. Args: - tableName: The table name (required) - key: The primary key of the item to delete - conditionExpression: Condition for the delete - expressionAttributeValues: Values for condition placeholders - expressionAttributeNames: Name substitutions Returns confirmation of the delete operation.

Update an item in a DynamoDB table. Args: - tableName: The table name (required) - key: The primary key of the item to update - updateExpression: Update expression (e.g., 'SET #n = :val, #s = :s') - expressionAttributeValues: Values for placeholders - expressionAttributeNames: Name substitutions - conditionExpression: Condition for the update Returns confirmation of the update operation.

Get multiple items from one or more DynamoDB tables in a single request. Args: - requestItems: Object mapping table names to keys and options Example requestItems: { "TableName": { "keys": [{"PK": {"S": "user#1"}}, {"PK": {"S": "user#2"}}], "projectionExpression": "attribute1, attribute2" } } Returns items grouped by table name.

Write (put or delete) multiple items to one or more DynamoDB tables. Args: - requestItems: Object mapping table names to write requests Example requestItems: { "TableName": [ {"putRequest": {"item": {"PK": {"S": "user#1"}, "data": {"S": "value"}}}}, {"deleteRequest": {"key": {"PK": {"S": "user#2"}}}} ] } Returns unprocessed items if any.

List availability zones in the current region. Returns list of availability zones with state and zone type.

Create a new DynamoDB table. Args: - tableName: Name for the new table (required) - keySchema: Array of key schema elements (required) - attributeName: Attribute name - keyType: 'HASH' (partition key) or 'RANGE' (sort key) - attributeDefinitions: Array of attribute definitions (required) - attributeName: Attribute name - attributeType: 'S' (string), 'N' (number), or 'B' (binary) - billingMode: 'PROVISIONED' or 'PAY_PER_REQUEST' (default: PAY_PER_REQUEST) - provisionedThroughput: Required if billingMode is PROVISIONED - readCapacityUnits: Read capacity units - writeCapacityUnits: Write capacity units Returns the created table details.

Delete a DynamoDB table. Args: - tableName: Name of the table to delete (required) WARNING: This action is irreversible. All data in the table will be permanently deleted. Returns confirmation of deletion.

List EC2 instances with optional filtering. Args: - instanceIds: Array of instance IDs to filter by - filters: Array of filters with name and values Returns list of instances with ID, type, state, IPs, and tags.

Enable or disable Time To Live (TTL) on a DynamoDB table. Args: - tableName: Name of the table (required) - attributeName: Name of the TTL attribute (required) - enabled: Enable (true) or disable (false) TTL (required) When enabled, items with the TTL attribute set to a past timestamp will be automatically deleted. Returns confirmation of TTL update.

Get the TTL settings for a DynamoDB table. Args: - tableName: Name of the table (required) Returns the TTL attribute name and status.

Create an on-demand backup of a DynamoDB table. Args: - tableName: Name of the table to backup (required) - backupName: Name for the backup (required) Returns the backup details.

List backups for DynamoDB tables. Args: - tableName: Filter by table name (optional) Returns list of backup summaries.

Get details of a DynamoDB backup. Args: - backupArn: The backup ARN (required) Returns backup details including size and status.

Delete a DynamoDB backup. Args: - backupArn: The backup ARN (required) Returns confirmation of deletion.

Restore a DynamoDB table from a backup. Args: - targetTableName: Name for the restored table (required) - backupArn: The backup ARN to restore from (required) Returns the restored table details.

Enable point-in-time recovery (PITR) for a DynamoDB table. Args: - tableName: Name of the table (required) Enables continuous backups which allow restore to any point in the last 35 days. Returns confirmation.

Get continuous backup (PITR) settings for a DynamoDB table. Args: - tableName: Name of the table (required) Returns PITR status and restore window.

Restore a DynamoDB table to a specific point in time. Args: - sourceTableName: Name of the source table (required) - targetTableName: Name for the restored table (required) - restoreDateTime: ISO timestamp to restore to (optional, uses latest if not specified) Requires point-in-time recovery to be enabled on the source table. Returns the restored table details.

Update a DynamoDB table's settings. Args: - tableName: Name of the table (required) - billingMode: 'PROVISIONED' or 'PAY_PER_REQUEST' (optional) - readCapacityUnits: Read capacity (required if switching to PROVISIONED) - writeCapacityUnits: Write capacity (required if switching to PROVISIONED) Returns the updated table details.

List DynamoDB global tables. Returns global tables with their replication regions.

Remove tags from a DynamoDB resource. Args: - resourceArn: The DynamoDB resource ARN (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation.

List EC2 security groups. Args: - groupIds: Array of security group IDs to filter by Returns security groups with their inbound/outbound rules.

List EBS volumes. Args: - volumeIds: Array of volume IDs to filter by Returns volumes with size, type, state, and attachments.

List VPCs in the region. Args: - vpcIds: Array of VPC IDs to filter by Returns VPCs with CIDR blocks and configuration.

List subnets in the region. Args: - subnetIds: Array of subnet IDs to filter by Returns subnets with CIDR blocks, AZ, and available IPs.

List AMI images. Args: - imageIds: Array of AMI IDs to filter by - owners: Array of owner IDs (e.g., ['self', 'amazon', '123456789012']) Returns AMIs with name, architecture, and platform info.

List EC2 key pairs for SSH access. Returns all key pairs with names and fingerprints.

Start one or more stopped EC2 instances. Args: - instanceIds: Array of instance IDs to start (required) Returns confirmation of the start operation.

Stop one or more running EC2 instances. Args: - instanceIds: Array of instance IDs to stop (required) Returns confirmation of the stop operation.

Reboot one or more EC2 instances. Args: - instanceIds: Array of instance IDs to reboot (required) Returns confirmation of the reboot operation.

Terminate (permanently delete) one or more EC2 instances. WARNING: This action is irreversible. The instances and their data will be permanently deleted. Args: - instanceIds: Array of instance IDs to terminate (required) Returns confirmation of the termination.

List EBS snapshots. Args: - snapshotIds: Array of snapshot IDs to filter by - ownerIds: Array of owner IDs (default: 'self') Returns list of snapshots with ID, volume, state, and size.

List NAT gateways. Args: - natGatewayIds: Array of NAT gateway IDs to filter by Returns list of NAT gateways with state, VPC, subnet, and addresses.

List EC2 launch templates. Args: - launchTemplateIds: Array of launch template IDs to filter by Returns list of launch templates with ID, name, and version info.

Create a new EC2 security group. Args: - groupName: Name of the security group (required) - description: Description of the security group (required) - vpcId: VPC ID to create the group in (optional, uses default VPC if not specified) Returns the security group ID.

Delete an EC2 security group. Args: - groupId: ID of the security group to delete (required) Returns confirmation of deletion.

List services in an ECS cluster. Args: - clusterArn: The cluster ARN (required) Returns service ARNs.

Add inbound rules to a security group. Args: - groupId: Security group ID (required) - rules: Array of rules to add (required) Each rule can include: - protocol: Protocol (tcp, udp, icmp, or -1 for all) - fromPort: Start of port range - toPort: End of port range - cidrIpv4: IPv4 CIDR range (e.g., '0.0.0.0/0') - cidrIpv6: IPv6 CIDR range - sourceSecurityGroupId: Source security group ID Returns confirmation of rule addition.

Remove inbound rules from a security group. Args: - groupId: Security group ID (required) - rules: Array of rules to remove (required) Each rule must match an existing rule exactly. Returns confirmation of rule removal.

Add outbound rules to a security group. Args: - groupId: Security group ID (required) - rules: Array of rules to add (required) Each rule can include: - protocol: Protocol (tcp, udp, icmp, or -1 for all) - fromPort: Start of port range - toPort: End of port range - cidrIpv4: IPv4 CIDR range - cidrIpv6: IPv6 CIDR range - sourceSecurityGroupId: Destination security group ID Returns confirmation of rule addition.

Remove outbound rules from a security group. Args: - groupId: Security group ID (required) - rules: Array of rules to remove (required) Each rule must match an existing rule exactly. Returns confirmation of rule removal.

Allocate a new Elastic IP address. Returns the allocation ID and public IP address.

Release an Elastic IP address. Args: - allocationId: Allocation ID of the Elastic IP (required) Returns confirmation of release.

Associate an Elastic IP with an instance or network interface. Args: - allocationId: Allocation ID of the Elastic IP (required) - instanceId: Instance ID to associate with (optional) - networkInterfaceId: Network interface ID to associate with (optional) Either instanceId or networkInterfaceId must be provided. Returns the association ID.

Disassociate an Elastic IP from an instance or network interface. Args: - associationId: Association ID (required) Returns confirmation of disassociation.

Add or overwrite tags on EC2 resources. Args: - resourceIds: Array of resource IDs to tag (required) - tags: Array of tags with key and value (required) Returns confirmation of tag creation.

Delete tags from EC2 resources. Args: - resourceIds: Array of resource IDs to untag (required) - tags: Array of tag keys to delete (required) Returns confirmation of tag deletion.

Create a new EBS volume. Args: - availabilityZone: The AZ to create the volume in (required) - size: Size in GiB (required if not creating from snapshot) - snapshotId: Snapshot ID to create from (optional) - volumeType: gp2, gp3, io1, io2, st1, sc1, standard (default: gp2) - iops: IOPS for io1/io2/gp3 volumes - encrypted: Enable encryption (optional) - kmsKeyId: KMS key for encryption (optional) Returns the created volume details.

Delete an EBS volume. WARNING: This action cannot be undone. Args: - volumeId: Volume ID to delete (required) Returns confirmation of deletion.

Attach an EBS volume to an EC2 instance. Args: - volumeId: Volume ID to attach (required) - instanceId: Instance ID to attach to (required) - device: Device name (e.g., /dev/sdf, /dev/xvdf) (required) Returns attachment details.

Detach an EBS volume from an EC2 instance. Args: - volumeId: Volume ID to detach (required) - force: Force detach (may cause data loss) (optional) Returns detachment details.

Create a snapshot of an EBS volume. Args: - volumeId: Volume ID to snapshot (required) - description: Description for the snapshot (optional) Returns the created snapshot details.

Delete an EBS snapshot. WARNING: This action cannot be undone. Args: - snapshotId: Snapshot ID to delete (required) Returns confirmation of deletion.

Copy an EBS snapshot, optionally to a different region. Args: - sourceSnapshotId: Source snapshot ID (required) - sourceRegion: Source region (required) - description: Description for the new snapshot (optional) Returns the new snapshot ID.

Create a new VPC. Args: - cidrBlock: The IPv4 CIDR block for the VPC (required, e.g., '10.0.0.0/16') - instanceTenancy: Instance tenancy option (optional: 'default' or 'dedicated') Returns the created VPC details.

Delete a VPC. Args: - vpcId: The VPC ID (required) Note: The VPC must have no dependencies (subnets, IGWs, etc.).

Create a subnet in a VPC. Args: - vpcId: The VPC ID (required) - cidrBlock: The IPv4 CIDR block for the subnet (required) - availabilityZone: The availability zone (optional) Returns the created subnet details.

Delete a subnet. Args: - subnetId: The subnet ID (required)

List internet gateways. Args: - internetGatewayIds: Filter by gateway IDs (optional) Returns internet gateways with their VPC attachments.

Create an internet gateway. Returns the created internet gateway ID.

Delete an internet gateway. Args: - internetGatewayId: The internet gateway ID (required) Note: The gateway must be detached from all VPCs first.

Attach an internet gateway to a VPC. Args: - internetGatewayId: The internet gateway ID (required) - vpcId: The VPC ID (required)

Detach an internet gateway from a VPC. Args: - internetGatewayId: The internet gateway ID (required) - vpcId: The VPC ID (required)

List route tables. Args: - routeTableIds: Filter by route table IDs (optional) Returns route tables with their routes.

Create a route table in a VPC. Args: - vpcId: The VPC ID (required) Returns the created route table ID.

Delete a route table. Args: - routeTableId: The route table ID (required) Note: Cannot delete the main route table.

Create a route in a route table. Args: - routeTableId: The route table ID (required) - destinationCidrBlock: Destination CIDR (required, e.g., '0.0.0.0/0') - gatewayId: Internet gateway ID (optional) - natGatewayId: NAT gateway ID (optional) One of gatewayId or natGatewayId is required.

Create a new ECS cluster. Args: - clusterName: The name for the new cluster (required) Returns the created cluster details.

Delete a route from a route table. Args: - routeTableId: The route table ID (required) - destinationCidrBlock: Destination CIDR of the route to delete (required)

Associate a route table with a subnet. Args: - routeTableId: The route table ID (required) - subnetId: The subnet ID (required) Returns the association ID.

Disassociate a route table from a subnet. Args: - associationId: The association ID (required)

List EC2 network interfaces. Args: - networkInterfaceIds: Array of network interface IDs (optional) Returns network interfaces with subnet, VPC, IP, and attachment info.

Create a network interface in a subnet. Args: - subnetId: The subnet ID (required) - description: Description for the interface (optional) - securityGroupIds: Security group IDs to attach (optional) Returns the created network interface details.

Delete a network interface. Args: - networkInterfaceId: The network interface ID (required) Note: The interface must be detached first.

Attach a network interface to an instance. Args: - networkInterfaceId: The network interface ID (required) - instanceId: The instance ID (required) - deviceIndex: The device index (required) Returns the attachment ID.

Detach a network interface from an instance. Args: - attachmentId: The attachment ID (required) - force: Force detachment (optional)

List EC2 placement groups. Args: - groupNames: Array of placement group names (optional) Returns placement groups with strategy and state.

Create an EC2 placement group. Args: - groupName: The placement group name (required) - strategy: The placement strategy: 'cluster', 'spread', or 'partition' (required) Returns the created placement group name.

Delete an EC2 placement group. Args: - groupName: The placement group name (required) Note: The group must not have any instances.

Modify an EC2 instance attribute. Args: - instanceId: The instance ID (required) - attribute: The attribute name (required, e.g., 'instanceType', 'userData', 'disableApiTermination') - value: The new value (required) Note: Instance must be stopped for some attributes.

Get the console output from an EC2 instance. Args: - instanceId: The instance ID (required) Returns the console output text (useful for debugging boot issues).

List all ECS clusters in the region. Returns cluster ARNs. Use describe_clusters for details.

Get details of ECS clusters. Args: - clusterArns: Array of cluster ARNs (required) Returns cluster details including running tasks and services.

Get details of ECS services. Args: - clusterArn: The cluster ARN (required) - serviceArns: Array of service ARNs (required) Returns service configuration including desired and running counts.

List tasks in an ECS cluster. Args: - clusterArn: The cluster ARN (required) - serviceName: Filter by service name (optional) Returns task ARNs.

Get details of ECS tasks. Args: - clusterArn: The cluster ARN (required) - taskArns: Array of task ARNs (required) Returns task details including status and containers.

Get details of an ECS task definition. Args: - taskDefinition: Task definition family:revision or ARN (required) Returns task definition including container definitions.

List ECS task definition ARNs. Args: - familyPrefix: Filter by task definition family prefix (optional) Returns task definition ARNs.

Update an ECS service. Args: - clusterArn: The cluster ARN (required) - serviceName: The service name (required) - desiredCount: New desired count (optional) - taskDefinition: New task definition (optional) - forceNewDeployment: Force a new deployment (optional) Returns the updated service details.

Run a new task in an ECS cluster. Args: - clusterArn: The cluster ARN (required) - taskDefinition: The task definition family:revision or ARN (required) - count: Number of tasks to run (optional, default: 1) - launchType: Launch type - 'EC2' or 'FARGATE' (optional) - networkConfiguration: Network configuration for FARGATE (optional) Returns the started task details.

Stop a running ECS task. Args: - clusterArn: The cluster ARN (required) - taskArn: The task ARN (required) - reason: Reason for stopping (optional) Returns the stopped task details.

Delete an ECS service. Args: - clusterArn: The cluster ARN (required) - serviceName: The service name (required) - force: Force delete even if service has running tasks (optional) Note: Before deleting, you should typically scale the service to 0 first, or use force=true to delete a service with running tasks. Returns the deleted service details.

Deregister an ECS task definition. Args: - taskDefinition: The task definition ARN or family:revision (required) Deregistered task definitions can no longer be used to run new tasks, but existing tasks using this definition will continue to run. Returns the deregistered task definition details.

List container instances in an ECS cluster. Args: - clusterArn: The cluster ARN (required) Returns container instance ARNs.

Get details of ECS container instances. Args: - clusterArn: The cluster ARN (required) - containerInstanceArns: Array of container instance ARNs (required) Returns container instance details including EC2 instance ID and task counts.

Delete an ECS cluster. Args: - clusterArn: The cluster ARN (required) Note: The cluster must not have any services or tasks running. Returns the deleted cluster details.

Create a new ECS service. Args: - clusterArn: The cluster ARN (required) - serviceName: The service name (required) - taskDefinition: The task definition (required) - desiredCount: Number of tasks to run (required) - launchType: Launch type - 'EC2' or 'FARGATE' (optional) - networkConfiguration: Network configuration for FARGATE (optional) Returns the created service details.

Add tags to an ECS resource. Args: - resourceArn: The ARN of the ECS resource (required) - tags: Array of tags to add (required) Returns confirmation.

Remove tags from an ECS resource. Args: - resourceArn: The ARN of the ECS resource (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation.

List tags on an ECS resource. Args: - resourceArn: The ARN of the ECS resource (required) Returns the resource tags.

List ECS task definition families. Args: - familyPrefix: Filter by family prefix (optional) Returns task definition family names.

Update the state of ECS container instances. Args: - clusterArn: The cluster ARN (required) - containerInstanceArns: Array of container instance ARNs (required) - status: New status - 'ACTIVE' or 'DRAINING' (required) Use DRAINING to stop new tasks from being placed on the instances. Returns the updated container instance details.

List all EKS clusters in the region. Returns cluster names. Use describe_cluster for details.

Get detailed information about an EKS cluster. Args: - name: The cluster name (required) Returns cluster configuration including endpoint, version, and VPC settings.

List all node groups in an EKS cluster. Args: - clusterName: The cluster name (required) Returns node group names.

Get detailed information about an EKS node group. Args: - clusterName: The cluster name (required) - nodegroupName: The node group name (required) Returns node group configuration including scaling settings and instance types.

List all Fargate profiles in an EKS cluster. Args: - clusterName: The cluster name (required) Returns Fargate profile names.

Get detailed information about an EKS Fargate profile. Args: - clusterName: The cluster name (required) - fargateProfileName: The Fargate profile name (required) Returns Fargate profile configuration including selectors and subnets.

List all addons in an EKS cluster. Args: - clusterName: The cluster name (required) Returns addon names. Use describe_addon for details.

Get detailed information about an EKS addon. Args: - clusterName: The cluster name (required) - addonName: The addon name (required) Returns addon configuration including version, status, and health.

List all identity provider configurations in an EKS cluster. Args: - clusterName: The cluster name (required) Returns identity provider config names and types.

Get detailed information about an EKS identity provider configuration. Args: - clusterName: The cluster name (required) - type: The identity provider type (e.g., 'oidc') (required) - name: The identity provider config name (required) Returns identity provider config details including OIDC settings.

List IAM instance profiles. Returns instance profiles with names, IDs, and attached roles.

Update the configuration of an EKS node group. Args: - clusterName: The cluster name (required) - nodegroupName: The node group name (required) - scalingConfig: Scaling configuration (optional) - minSize: Minimum number of nodes - maxSize: Maximum number of nodes - desiredSize: Desired number of nodes Returns the update ID and status.

Add tags to an EKS resource. Args: - resourceArn: The ARN of the EKS resource (required) - tags: Tags to add as key-value pairs (required) Returns confirmation.

Remove tags from an EKS resource. Args: - resourceArn: The ARN of the EKS resource (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation.

List updates for an EKS cluster, nodegroup, or addon. Args: - clusterName: The cluster name (required) - nodegroupName: Filter updates for a specific nodegroup (optional) - addonName: Filter updates for a specific addon (optional) Returns update IDs.

Get details of an EKS update. Args: - clusterName: The cluster name (required) - updateId: The update ID (required) - nodegroupName: If this was a nodegroup update (optional) - addonName: If this was an addon update (optional) Returns update details including status and errors.

List all IAM users in the account. Returns users with their names, IDs, creation dates, and last login times.

Get detailed information about an IAM user. Args: - userName: The IAM user name (required) Returns user details including ARN, creation date, and password last used.

List all IAM roles in the account. Returns roles with their names, IDs, ARNs, and descriptions.

Get detailed information about an IAM role. Args: - roleName: The IAM role name (required) Returns role details including trust policy and description.

List IAM policies in the account. Args: - onlyAttached: If true, only return policies attached to users/groups/roles Returns policies with names, ARNs, and attachment counts.

Get detailed information about an IAM policy. Args: - policyArn: The policy ARN (required) Returns policy details including attachment count and description.

List all IAM groups in the account. Returns groups with their names, IDs, and ARNs.

List access keys for an IAM user. Args: - userName: The IAM user name (required) Returns access keys with their IDs, status, and creation dates.

List managed policies attached to an IAM user. Args: - userName: The IAM user name (required) Returns attached policies with names and ARNs.

List managed policies attached to an IAM role. Args: - roleName: The IAM role name (required) Returns attached policies with names and ARNs.

List IAM groups that a user belongs to. Args: - userName: The IAM user name (required) Returns groups with names, IDs, and ARNs.

List MFA devices for an IAM user. Args: - userName: The IAM user name (optional, defaults to current user) Returns MFA devices with serial numbers and enable dates.

Get details of an IAM instance profile. Args: - instanceProfileName: The instance profile name (required) Returns instance profile details including attached roles.

Create a new IAM user. Args: - userName: The name for the new user (required) Returns the created user details.

Delete an IAM user. Args: - userName: The name of the user to delete (required) Note: The user must have no attached policies, access keys, or other resources before deletion. Returns confirmation of deletion.

Create a new IAM role. Args: - roleName: The name for the new role (required) - assumeRolePolicyDocument: Trust policy as JSON string (required) - description: Role description (optional) Returns the created role details.

Delete an IAM role. Args: - roleName: The name of the role to delete (required) Note: The role must have no attached policies or instance profiles before deletion. Returns confirmation of deletion.

Attach a managed policy to an IAM user. Args: - userName: The user name (required) - policyArn: The ARN of the policy to attach (required) Returns confirmation of attachment.

Detach a managed policy from an IAM user. Args: - userName: The user name (required) - policyArn: The ARN of the policy to detach (required) Returns confirmation of detachment.

Attach a managed policy to an IAM role. Args: - roleName: The role name (required) - policyArn: The ARN of the policy to attach (required) Returns confirmation of attachment.

Detach a managed policy from an IAM role. Args: - roleName: The role name (required) - policyArn: The ARN of the policy to detach (required) Returns confirmation of detachment.

Create a new access key for an IAM user. Args: - userName: The user name (required) WARNING: The secret access key is only available at creation time. Make sure to save it securely. Returns the new access key ID and secret access key.

Delete an access key for an IAM user. Args: - userName: The user name (required) - accessKeyId: The access key ID to delete (required) Returns confirmation of deletion.

Activate or deactivate an access key. Args: - userName: The user name (required) - accessKeyId: The access key ID (required) - status: 'Active' or 'Inactive' (required) Returns confirmation.

Create a new IAM policy. Args: - policyName: Name for the policy (required) - policyDocument: JSON policy document (required) - description: Description of the policy (optional) Returns the created policy details.

Delete an IAM policy. Args: - policyArn: The policy ARN (required) Note: Policy must be detached from all users, groups, and roles first. All policy versions except the default must be deleted first. Returns confirmation.

Get a specific version of an IAM policy. Args: - policyArn: The policy ARN (required) - versionId: The version ID (required, e.g., 'v1', 'v2') Returns the policy document for that version.

List all versions of an IAM policy. Args: - policyArn: The policy ARN (required) Returns version IDs and which is the default.

Create a new version of an IAM policy. Args: - policyArn: The policy ARN (required) - policyDocument: New policy document JSON (required) - setAsDefault: Set as the default version (optional) A policy can have up to 5 versions. Delete old versions if at the limit. Returns the new version ID.

Delete a specific version of an IAM policy. Args: - policyArn: The policy ARN (required) - versionId: The version ID to delete (required) Note: Cannot delete the default version. Returns confirmation.

Add an IAM user to a group. Args: - groupName: The group name (required) - userName: The user name (required) Returns confirmation.

Remove an IAM user from a group. Args: - groupName: The group name (required) - userName: The user name (required) Returns confirmation.

Create a new IAM group. Args: - groupName: Name for the group (required) Returns the created group details.

Delete an IAM group. Args: - groupName: The group name (required) Note: Group must be empty (no users) and have no policies attached. Returns confirmation.

Add or update tags on an IAM user. Args: - userName: The user name (required) - tags: Array of tags to add (required) Returns confirmation.

Get the status of a Route53 change request. Args: - changeId: The change ID (required) Returns change status (PENDING or INSYNC).

Remove tags from an IAM user. Args: - userName: The user name (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation.

Add or update tags on an IAM role. Args: - roleName: The role name (required) - tags: Array of tags to add (required) Returns confirmation.

Remove tags from an IAM role. Args: - roleName: The role name (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation.

List all Lambda functions in the region. Returns functions with name, runtime, memory, timeout, and last modified date.

Get detailed information about a Lambda function. Args: - functionName: The function name or ARN (required) Returns full function configuration including environment variables and tags.

Invoke a Lambda function and get its response. Args: - functionName: The function name or ARN (required) - payload: JSON payload to pass to the function - invocationType: 'RequestResponse' (sync), 'Event' (async), or 'DryRun' Returns the function's response payload for sync invocations.

List aliases for a Lambda function. Args: - functionName: The function name or ARN (required) Returns aliases with their versions and descriptions.

List published versions of a Lambda function. Args: - functionName: The function name or ARN (required) Returns version numbers with descriptions and modification dates.

List event source mappings for Lambda functions. Args: - functionName: Filter by function name (optional) Returns event source mappings with UUID, state, and batch settings.

List Lambda layers available in the region. Returns layer names and ARNs with latest version info.

List versions of a Lambda layer. Args: - layerName: The layer name (required) Returns layer versions with compatible runtimes and architectures.

Get the reserved concurrency setting for a Lambda function. Args: - functionName: The function name (required) Returns the reserved concurrent executions count (if set).

Publish a new version of a Lambda function. Args: - functionName: The function name (required) - description: Version description (optional) Returns the published version details.

Update the configuration of a Lambda function. Args: - functionName: The function name (required) - description: New description (optional) - handler: New handler (optional) - memorySize: New memory size in MB (optional) - timeout: New timeout in seconds (optional) - runtime: New runtime (optional) - environment: New environment variables (optional) Returns the updated function configuration.

Delete a Lambda function. Args: - functionName: The function name (required) - qualifier: Version or alias to delete (optional, deletes all versions if not specified) WARNING: This action is irreversible. Returns confirmation of deletion.

Set reserved concurrency for a Lambda function. Args: - functionName: The function name (required) - reservedConcurrency: Number of concurrent executions to reserve (required) Returns confirmation of the concurrency setting.

Remove reserved concurrency from a Lambda function. Args: - functionName: The function name (required) This allows the function to use unreserved account concurrency. Returns confirmation of removal.

Get details of an event source mapping. Args: - uuid: The event source mapping UUID (required) Returns mapping details including state and batch settings.

Create an event source mapping for a Lambda function. Args: - eventSourceArn: ARN of the event source (SQS, DynamoDB, Kinesis) (required) - functionName: Function name or ARN (required) - batchSize: Number of records per batch (optional) - enabled: Whether the mapping is enabled (optional, default: true) - startingPosition: Starting position for stream (TRIM_HORIZON, LATEST) (optional) Returns the created mapping details.

Update an event source mapping. Args: - uuid: The event source mapping UUID (required) - functionName: New function name or ARN (optional) - batchSize: New batch size (optional) - enabled: Enable or disable the mapping (optional) Returns the updated mapping details.

Delete an event source mapping. Args: - uuid: The event source mapping UUID (required) Returns confirmation of deletion.

Create an alias for a Lambda function version. Args: - functionName: The function name (required) - name: Alias name (required) - functionVersion: Version to point to (required) - description: Alias description (optional) Returns the created alias details.

Update a Lambda function alias. Args: - functionName: The function name (required) - name: Alias name (required) - functionVersion: New version to point to (optional) - description: New description (optional) Returns the updated alias details.

Delete a Lambda function alias. Args: - functionName: The function name (required) - name: Alias name (required) Returns confirmation of deletion.

Add a permission to a Lambda function's resource-based policy. Args: - functionName: The function name (required) - statementId: A unique identifier for the policy statement (required) - action: The Lambda action to allow (required, e.g., 'lambda:InvokeFunction') - principal: The principal to grant permission to (required, e.g., 's3.amazonaws.com') - sourceArn: ARN of the source triggering the function (optional) Returns the policy statement.

Remove a permission from a Lambda function's resource-based policy. Args: - functionName: The function name (required) - statementId: The statement ID to remove (required) Returns confirmation of removal.

Get the resource-based policy for a Lambda function. Args: - functionName: The function name (required) Returns the function's policy document.

Add tags to a Lambda function. Args: - resourceArn: The function ARN (required) - tags: Key-value pairs of tags (required) Returns confirmation of tagging.

Remove tags from a Lambda function. Args: - resourceArn: The function ARN (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation of tag removal.

List tags for a Lambda function. Args: - resourceArn: The function ARN (required) Returns the function's tags.

List RDS database instances. Args: - dbInstanceIdentifier: Filter by instance ID (optional) Returns instances with engine, class, status, and endpoint.

List RDS Aurora database clusters. Args: - dbClusterIdentifier: Filter by cluster ID (optional) Returns clusters with engine, status, and endpoints.

List RDS database snapshots. Args: - dbInstanceIdentifier: Filter by source DB instance (optional) Returns snapshots with type, status, and creation time.

List RDS DB parameter groups. Args: - dbParameterGroupName: Filter by parameter group name (optional) Returns parameter groups with families and descriptions.

List RDS DB subnet groups. Args: - dbSubnetGroupName: Filter by subnet group name (optional) Returns subnet groups with VPCs and subnets.

Create a manual snapshot of an RDS database instance. Args: - dbInstanceIdentifier: The DB instance identifier (required) - dbSnapshotIdentifier: The name for the snapshot (required) Returns the snapshot details.

Delete an RDS database snapshot. Args: - dbSnapshotIdentifier: The snapshot identifier (required) WARNING: This action is irreversible. Returns confirmation of deletion.

Start a stopped RDS database instance. Args: - dbInstanceIdentifier: The DB instance identifier (required) Returns the instance details.

Stop a running RDS database instance. Args: - dbInstanceIdentifier: The DB instance identifier (required) - dbSnapshotIdentifier: Name for a final snapshot before stopping (optional) Returns the instance details.

Reboot an RDS database instance. Args: - dbInstanceIdentifier: The DB instance identifier (required) - forceFailover: Force failover to a standby in Multi-AZ deployment (optional) Returns the instance details.

Delete an RDS database instance. Args: - dbInstanceIdentifier: The DB instance identifier (required) - skipFinalSnapshot: Skip creating a final snapshot (default: false) - finalSnapshotIdentifier: Name for the final snapshot (required if skipFinalSnapshot is false) WARNING: This action is irreversible if skipFinalSnapshot is true. Returns the instance details.

List all S3 buckets in the AWS account. Returns a list of all S3 buckets with their names and creation dates.

Modify an RDS database instance. Args: - dbInstanceIdentifier: The DB instance identifier (required) - dbInstanceClass: New instance class (e.g., 'db.t3.medium') - allocatedStorage: New storage size in GB - masterUserPassword: New master password - backupRetentionPeriod: Days to retain backups (0-35) - multiAZ: Enable/disable Multi-AZ deployment - applyImmediately: Apply changes immediately (default: next maintenance window) Returns the instance details.

List RDS Aurora cluster snapshots. Args: - dbClusterIdentifier: Filter by source DB cluster (optional) Returns cluster snapshots with type, status, and creation time.

Create a manual snapshot of an RDS Aurora cluster. Args: - dbClusterIdentifier: The DB cluster identifier (required) - dbClusterSnapshotIdentifier: The name for the snapshot (required) Returns the snapshot details.

Delete an RDS Aurora cluster snapshot. Args: - dbClusterSnapshotIdentifier: The cluster snapshot identifier (required) WARNING: This action is irreversible. Returns confirmation of deletion.

List RDS DB security groups (for EC2-Classic). Args: - dbSecurityGroupName: Filter by security group name (optional) Returns DB security groups with descriptions.

List RDS option groups. Args: - optionGroupName: Filter by option group name (optional) Returns option groups with engines and versions.

List available RDS database engine versions. Args: - engine: Filter by engine name (e.g., 'mysql', 'postgres') (optional) Returns engine versions with upgrade targets.

List available DB instance options for an engine. Args: - engine: The DB engine name (required, e.g., 'mysql', 'postgres') Returns available instance classes and configurations.

List RDS events. Args: - sourceType: Filter by source type (e.g., 'db-instance', 'db-cluster') (optional) - sourceIdentifier: Filter by source identifier (optional) - duration: Events from the last N minutes (optional, default: 60) Returns recent RDS events.

List pending maintenance actions for RDS resources. Args: - resourceIdentifier: Filter by resource ARN (optional) Returns pending maintenance actions with details.

Add tags to an RDS resource. Args: - resourceArn: The ARN of the RDS resource (required) - tags: Array of tags to add (required) Returns confirmation.

Remove tags from an RDS resource. Args: - resourceArn: The ARN of the RDS resource (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation.

List tags on an RDS resource. Args: - resourceArn: The ARN of the RDS resource (required) Returns the resource tags.

Restore an RDS instance from a snapshot. Args: - dbInstanceIdentifier: The new DB instance identifier (required) - dbSnapshotIdentifier: The source snapshot identifier (required) - dbInstanceClass: The instance class (optional, uses snapshot setting if not specified) Returns the new instance details.

Copy an RDS database snapshot. Args: - sourceSnapshotIdentifier: The source snapshot identifier (required) - targetSnapshotIdentifier: The target snapshot name (required) Returns the new snapshot details.

List all Route53 hosted zones. Returns zones with names, IDs, and record counts.

List DNS record sets in a hosted zone. Args: - hostedZoneId: The hosted zone ID (required) Returns DNS records with names, types, and values.

Create, update, or delete DNS record sets in a hosted zone. Args: - hostedZoneId: The hosted zone ID (required) - changes: Array of changes to apply Each change requires: - action: 'CREATE', 'DELETE', or 'UPSERT' - resourceRecordSet: The record set to create/update/delete - name: Record name (e.g., 'example.com.') - type: Record type (e.g., 'A', 'CNAME', 'TXT') - ttl: Time to live in seconds - resourceRecords: Array of {value} for record values Returns change status and ID.

List Route53 health checks. Returns health checks with their configurations and endpoints.

Get detailed information about a Route53 hosted zone. Args: - hostedZoneId: The hosted zone ID (required) Returns zone details including name, configuration, and record count.

Create a new Route53 hosted zone. Args: - name: The domain name (e.g., 'example.com.') (required) - callerReference: A unique string to identify the request (required) - comment: Optional comment about the zone - privateZone: Set to true for a private hosted zone (requires VPC) - vpcId: VPC ID for private zones - vpcRegion: VPC region for private zones Returns the created zone and change info.

Delete a Route53 hosted zone. Args: - hostedZoneId: The hosted zone ID (required) Note: The zone must not have any non-NS/SOA records. Returns change status.

Get detailed information about a Route53 health check. Args: - healthCheckId: The health check ID (required) Returns health check configuration and status.

Create a Route53 health check. Args: - callerReference: A unique string to identify the request (required) - type: Health check type: HTTP, HTTPS, HTTP_STR_MATCH, HTTPS_STR_MATCH, TCP (required) - ipAddress: IP address to check (optional, provide either this or FQDN) - port: Port number (optional, defaults based on type) - resourcePath: Path for HTTP/HTTPS checks (optional) - fullyQualifiedDomainName: Domain name to check (optional) - requestInterval: Seconds between checks: 10 or 30 (optional) - failureThreshold: Number of failures before unhealthy: 1-10 (optional) Returns the created health check.

Delete a Route53 health check. Args: - healthCheckId: The health check ID (required) Returns confirmation of deletion.

List objects in an S3 bucket. Args: - bucket: The bucket name (required) - prefix: Filter objects by prefix - delimiter: Delimiter for grouping (usually '/') - maxKeys: Maximum number of keys to return (default: 1000) - continuationToken: Token for pagination Returns paginated list of objects with keys, sizes, and metadata.

Get the contents of an S3 object. Args: - bucket: The bucket name (required) - key: The object key (required) Returns the object contents as text. Best for text files, JSON, etc. For binary files, consider using presigned URLs instead.

Upload an object to S3. Args: - bucket: The bucket name (required) - key: The object key/path (required) - body: The content to upload (required) - contentType: MIME type (default: application/octet-stream) Returns confirmation with the object's ETag.

Delete an object from S3. Args: - bucket: The bucket name (required) - key: The object key (required) Returns confirmation of deletion.

Copy an object within or between S3 buckets. Args: - sourceBucket: Source bucket name (required) - sourceKey: Source object key (required) - destinationBucket: Destination bucket name (required) - destinationKey: Destination object key (required) Returns confirmation of the copy operation.

Get the AWS region where an S3 bucket is located. Args: - bucket: The bucket name (required) Returns the region name (e.g., 'us-east-1', 'eu-west-1').

Get metadata about an S3 object without downloading it. Args: - bucket: The bucket name (required) - key: The object key (required) Returns object metadata including size, content type, and last modified date.

Delete multiple objects from S3 in a single request. Args: - bucket: The bucket name (required) - keys: Array of object keys to delete (required, max 1000) Returns list of deleted keys and any errors.

Get the versioning configuration for an S3 bucket. Args: - bucket: The bucket name (required) Returns versioning status ('Enabled', 'Suspended', or not set).

Create a new S3 bucket. Args: - bucket: The bucket name (required) - region: AWS region for the bucket (optional, uses client region if not specified) Returns confirmation of bucket creation.

Delete an S3 bucket. Args: - bucket: The bucket name (required) Note: The bucket must be empty before it can be deleted. Returns confirmation of bucket deletion.

Get the bucket policy for an S3 bucket. Args: - bucket: The bucket name (required) Returns the bucket policy as a JSON string.

Set the bucket policy for an S3 bucket. Args: - bucket: The bucket name (required) - policy: The bucket policy as a JSON string (required) Returns confirmation of policy update.

Delete the bucket policy for an S3 bucket. Args: - bucket: The bucket name (required) Returns confirmation of policy deletion.

Get the CORS configuration for an S3 bucket. Args: - bucket: The bucket name (required) Returns the CORS rules configured for the bucket.

Set the CORS configuration for an S3 bucket. Args: - bucket: The bucket name (required) - rules: Array of CORS rules (required) Each rule can include: - allowedOrigins: Array of allowed origins (required) - allowedMethods: Array of allowed HTTP methods (required) - allowedHeaders: Array of allowed headers (optional) - exposeHeaders: Array of headers to expose (optional) - maxAgeSeconds: Cache duration in seconds (optional) Returns confirmation of CORS configuration update.

Delete the CORS configuration for an S3 bucket. Args: - bucket: The bucket name (required) Returns confirmation of CORS configuration deletion.

Get the tags for an S3 bucket. Args: - bucket: The bucket name (required) Returns the tags configured for the bucket.

Set tags for an S3 bucket. Args: - bucket: The bucket name (required) - tags: Array of tags with key and value (required) Returns confirmation of tagging update.

Delete all tags from an S3 bucket. Args: - bucket: The bucket name (required) Returns confirmation of tagging deletion.

Enable or suspend versioning for an S3 bucket. Args: - bucket: The bucket name (required) - status: 'Enabled' or 'Suspended' (required) Returns confirmation of versioning configuration update.

Get the lifecycle configuration for an S3 bucket. Args: - bucket: The bucket name (required) Returns lifecycle rules including expiration and transition settings.

Set the lifecycle configuration for an S3 bucket. Args: - bucket: The bucket name (required) - rules: Array of lifecycle rules (required) Each rule can include: - id: Rule identifier - status: 'Enabled' or 'Disabled' - prefix: Object key prefix for the rule - expiration: Object expiration settings - transitions: Storage class transitions Returns confirmation of lifecycle configuration update.

Delete the lifecycle configuration for an S3 bucket. Args: - bucket: The bucket name (required) Returns confirmation of lifecycle configuration deletion.

Get the server-side encryption configuration for an S3 bucket. Args: - bucket: The bucket name (required) Returns encryption rules including SSE algorithm and KMS key.

Set the server-side encryption configuration for an S3 bucket. Args: - bucket: The bucket name (required) - sseAlgorithm: 'AES256' for S3-managed keys or 'aws:kms' for KMS (required) - kmsMasterKeyId: KMS key ID (required if sseAlgorithm is 'aws:kms') Returns confirmation of encryption configuration update.

Delete the server-side encryption configuration for an S3 bucket. Args: - bucket: The bucket name (required) Returns confirmation of encryption configuration deletion.

Get the static website configuration for an S3 bucket. Args: - bucket: The bucket name (required) Returns website configuration including index and error documents.

Get attributes of an SNS subscription. Args: - subscriptionArn: The subscription ARN (required) Returns subscription attributes including delivery policy and filter policy.

Configure an S3 bucket for static website hosting. Args: - bucket: The bucket name (required) - indexDocument: Default index document (e.g., 'index.html') - errorDocument: Error document (e.g., 'error.html') - redirectAllRequestsTo: Redirect all requests to another host (optional) Returns confirmation of website configuration update.

Delete the static website configuration for an S3 bucket. Args: - bucket: The bucket name (required) Returns confirmation of website configuration deletion.

Get the tags for an S3 object. Args: - bucket: The bucket name (required) - key: The object key (required) Returns the tags configured for the object.

Set tags for an S3 object. Args: - bucket: The bucket name (required) - key: The object key (required) - tags: Array of tags with key and value (required) Returns confirmation of tagging update.

Delete all tags from an S3 object. Args: - bucket: The bucket name (required) - key: The object key (required) Returns confirmation of tagging deletion.

Get the access control list (ACL) for a bucket. Args: - bucket: The S3 bucket name (required) Returns the bucket owner and grants.

Get the access control list (ACL) for an object. Args: - bucket: The S3 bucket name (required) - key: The object key (required) Returns the object owner and grants.

List object versions in a versioning-enabled bucket. Args: - bucket: The S3 bucket name (required) - prefix: Filter objects by prefix (optional) Returns versions and delete markers.

Get the logging configuration for a bucket. Args: - bucket: The S3 bucket name (required) Returns the logging target bucket and prefix.

Enable access logging for a bucket. Args: - bucket: The S3 bucket name (required) - targetBucket: The bucket to store logs (required) - targetPrefix: Prefix for log files (optional) Returns confirmation.

Get the notification configuration for a bucket. Args: - bucket: The S3 bucket name (required) Returns Lambda, SQS, and SNS notification configurations.

List all secrets in Secrets Manager. Returns secret metadata (not values). Use get_secret_value to retrieve values.

Get the value of a secret from Secrets Manager. Args: - secretId: The secret name or ARN (required) Returns the secret value (string or binary). WARNING: This returns sensitive data. Handle with care.

Get metadata about a secret (without the value). Args: - secretId: The secret name or ARN (required) Returns secret metadata including rotation status and tags.

Create a new secret in Secrets Manager. Args: - name: The secret name (required) - secretString: The secret value (required for string secrets) - description: Optional description - kmsKeyId: Optional KMS key ID for encryption - tags: Optional tags as [{key, value}] Returns the created secret ARN and name.

Update the value of an existing secret. Args: - secretId: The secret name or ARN (required) - secretString: The new secret value (required) Returns the updated secret ARN and version ID.

Delete a secret from Secrets Manager. By default, secrets are scheduled for deletion after a recovery window. Use forceDeleteWithoutRecovery to delete immediately (cannot be undone). Args: - secretId: The secret name or ARN (required) - forceDeleteWithoutRecovery: Delete immediately without recovery window Returns deletion confirmation with scheduled deletion date.

Restore a previously deleted secret that is scheduled for deletion. Args: - secretId: The secret name or ARN (required) Returns the restored secret ARN and name. Note: Only works for secrets that are scheduled for deletion, not immediately deleted.

List queues that have this queue configured as their dead-letter queue. Args: - queueUrl: The dead-letter queue URL (required) Returns URLs of source queues that send failed messages to this DLQ.

Trigger immediate rotation of a secret. Args: - secretId: The secret name or ARN (required) - rotationLambdaARN: ARN of the Lambda function for rotation (optional, uses existing if not specified) Returns the rotated secret ARN, name, and new version ID. Note: Requires rotation to be configured on the secret.

Store a new secret value for an existing secret. Creates a new version of the secret with the provided value. Unlike update_secret, this does not modify the secret's metadata. Args: - secretId: The secret name or ARN (required) - secretString: The new secret value (required) - versionStages: Version stages to attach (optional, defaults to AWSCURRENT) Returns the secret ARN, name, and version ID of the new version.

Add or update tags on a secret. Args: - secretId: The secret name or ARN (required) - tags: Array of tags to add (required) Returns confirmation.

Remove tags from a secret. Args: - secretId: The secret name or ARN (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation.

Get the resource-based policy attached to a secret. Args: - secretId: The secret name or ARN (required) Returns the policy JSON if one is attached.

Attach a resource-based policy to a secret. Args: - secretId: The secret name or ARN (required) - resourcePolicy: The policy document as JSON string (required) Returns confirmation.

Delete the resource-based policy from a secret. Args: - secretId: The secret name or ARN (required) Returns confirmation.

Cancel an in-progress rotation for a secret. Args: - secretId: The secret name or ARN (required) Returns confirmation.

List all versions of a secret. Args: - secretId: The secret name or ARN (required) Returns version IDs, stages, and creation dates.

Move a staging label to a different version of a secret. Args: - secretId: The secret name or ARN (required) - versionStage: The staging label to move (required) - moveToVersionId: Version ID to move the label to (optional) - removeFromVersionId: Version ID to remove the label from (optional) Use this to promote a version to AWSCURRENT or manage custom labels. Returns confirmation.

List all SNS topics in the region. Returns topic ARNs.

List SNS subscriptions. Args: - topicArn: Filter by topic ARN (optional) Returns subscriptions with endpoints and protocols.

Publish a message to an SNS topic or endpoint. Args: - topicArn: The topic ARN to publish to - targetArn: Alternative target ARN (e.g., for direct endpoint) - message: The message content (required) - subject: Subject for email endpoints Returns the message ID.

Get attributes of an SNS topic. Args: - topicArn: The topic ARN (required) Returns topic configuration including subscriptions and delivery policy.

Subscribe an endpoint to an SNS topic. Args: - topicArn: The topic ARN (required) - protocol: The protocol (email, sms, sqs, lambda, http, https, application) - endpoint: The endpoint (email address, phone number, queue ARN, etc.) Returns the subscription ARN (or 'pending confirmation' for email).

Create a new SNS topic. Args: - name: The topic name (required). For FIFO topics, must end with '.fifo' - attributes: Optional topic attributes - displayName: Display name for the topic - kmsMasterKeyId: KMS key ID for encryption - fifoTopic: Whether this is a FIFO topic - contentBasedDeduplication: Enable content-based deduplication (FIFO only) Returns the new topic ARN.

Delete an SNS topic. WARNING: This action cannot be undone. Args: - topicArn: The topic ARN (required) Returns confirmation of deletion.

Unsubscribe an endpoint from an SNS topic. Args: - subscriptionArn: The subscription ARN (required) Returns confirmation of unsubscription.

Set an attribute on an SNS topic. Args: - topicArn: The topic ARN (required) - attributeName: The attribute name (required) - attributeValue: The attribute value (required) Supported attributes: - DisplayName: Topic display name - Policy: Access policy JSON - DeliveryPolicy: Delivery retry policy JSON - KmsMasterKeyId: KMS key ID for encryption Returns confirmation of update.

Add or update tags on an SNS resource (topic or subscription). Args: - resourceArn: The resource ARN (required) - tags: Tags to add (required) Returns confirmation of tagging.

List tags on an SNS resource (topic or subscription). Args: - resourceArn: The resource ARN (required) Returns the resource tags.

Confirm a pending subscription using the token from the confirmation message. Args: - topicArn: The topic ARN (required) - token: The confirmation token from the subscription message (required) Returns the confirmed subscription ARN.

Set an attribute on an SNS subscription. Args: - subscriptionArn: The subscription ARN (required) - attributeName: The attribute name (required) - attributeValue: The attribute value (required) Supported attributes: - DeliveryPolicy: Delivery retry policy JSON - FilterPolicy: Message filter policy JSON - RawMessageDelivery: 'true' or 'false' - RedrivePolicy: Dead-letter queue policy JSON Returns confirmation of update.

Remove tags from an SNS resource (topic or subscription). Args: - resourceArn: The resource ARN (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation of untagging.

Publish multiple messages to an SNS topic in a single request. Args: - topicArn: The topic ARN (required) - entries: Array of message entries (required, max 10) - id: Unique identifier for the message (required) - message: Message content (required) - subject: Subject for email endpoints (optional) Returns successful and failed message results.

List all SQS queues in the region. Returns queue URLs. Use get_queue_attributes for details.

Get attributes of an SQS queue. Args: - queueUrl: The queue URL (required) Returns queue configuration and message counts.

Send a message to an SQS queue. Args: - queueUrl: The queue URL (required) - messageBody: The message content (required) - delaySeconds: Delay before message becomes visible (0-900) Returns the message ID.

Get details about the IAM user or role whose credentials are used to call the operation. Returns the AWS account ID, IAM user/role ARN, and unique identifier.

Receive messages from an SQS queue. Args: - queueUrl: The queue URL (required) - maxNumberOfMessages: Max messages to receive (1-10, default: 1) - visibilityTimeout: How long to hide message (seconds) - waitTimeSeconds: Long polling timeout (0-20, default: 0) Returns messages with bodies and receipt handles. IMPORTANT: Messages must be deleted after processing.

Delete a message from an SQS queue. Args: - queueUrl: The queue URL (required) - receiptHandle: The receipt handle from receive (required) Returns confirmation of deletion.

Delete all messages from an SQS queue. WARNING: This action cannot be undone. Args: - queueUrl: The queue URL (required) Returns confirmation of the purge.

Create a new SQS queue. Args: - queueName: The queue name (required). For FIFO queues, must end with '.fifo' - attributes: Optional queue attributes - delaySeconds: Default delay for messages (0-900) - maximumMessageSize: Max message size in bytes (1024-262144) - messageRetentionPeriod: How long to retain messages in seconds (60-1209600) - visibilityTimeout: Default visibility timeout (0-43200) - fifoQueue: Whether this is a FIFO queue - contentBasedDeduplication: Enable content-based deduplication (FIFO only) Returns the new queue URL.

Delete an SQS queue. WARNING: This action cannot be undone. All messages in the queue will be deleted. Args: - queueUrl: The queue URL (required) Returns confirmation of deletion.

Get the URL of an SQS queue by its name. Args: - queueName: The queue name (required) Returns the queue URL.

Set attributes on an SQS queue. Args: - queueUrl: The queue URL (required) - attributes: Attributes to set (required) Supported attributes: - DelaySeconds: Message delay (0-900 seconds) - MaximumMessageSize: Max message size (1024-262144 bytes) - MessageRetentionPeriod: Retention (60-1209600 seconds) - VisibilityTimeout: Visibility timeout (0-43200 seconds) - Policy: Queue policy JSON - RedrivePolicy: Dead-letter queue config JSON Returns confirmation of update.

Add or update tags on an SQS queue. Args: - queueUrl: The queue URL (required) - tags: Tags to add (required) Returns confirmation of tagging.

List tags on an SQS queue. Args: - queueUrl: The queue URL (required) Returns the queue tags.

Remove tags from an SQS queue. Args: - queueUrl: The queue URL (required) - tagKeys: Array of tag keys to remove (required) Returns confirmation of untagging.

Send multiple messages to an SQS queue in a single request. Args: - queueUrl: The queue URL (required) - entries: Array of message entries (required, max 10) - id: Unique identifier for tracking (required) - messageBody: Message content (required) - delaySeconds: Delay before message becomes visible (optional) Returns successful and failed message results.

Delete multiple messages from an SQS queue in a single request. Args: - queueUrl: The queue URL (required) - entries: Array of delete entries (required, max 10) - id: Unique identifier for tracking (required) - receiptHandle: Receipt handle from receive (required) Returns successful and failed delete results.

Change the visibility timeout of a message. Args: - queueUrl: The queue URL (required) - receiptHandle: Receipt handle from receive (required) - visibilityTimeout: New visibility timeout in seconds (required, 0-43200) Use this to extend processing time or make a message immediately visible again. Returns confirmation.

Change visibility timeout for multiple messages in a single request. Args: - queueUrl: The queue URL (required) - entries: Array of visibility change entries (required, max 10) - id: Unique identifier for tracking (required) - receiptHandle: Receipt handle from receive (required) - visibilityTimeout: New visibility timeout in seconds (required) Returns successful and failed results.

Assume an IAM role and get temporary security credentials. Args: - roleArn: The ARN of the role to assume (required) - roleSessionName: An identifier for the assumed role session (required) - durationSeconds: Duration of the session in seconds (optional, 900-43200, default 3600) - externalId: External ID for cross-account access (optional) Returns temporary credentials including access key, secret key, and session token.

Get temporary security credentials for an IAM user. Args: - durationSeconds: Duration of the session in seconds (optional, 900-129600, default 43200) This is useful for MFA-protected API access. The credentials can be used to call AWS APIs. Returns temporary credentials including access key, secret key, and session token.

Get temporary security credentials for a federated user. Args: - name: The name of the federated user (required, 2-32 characters) - durationSeconds: Duration of the session in seconds (optional, 900-129600, default 43200) - policy: An IAM policy in JSON format to limit permissions (optional) This returns credentials with permissions that are the intersection of the IAM user's permissions and the policy you specify. Returns temporary credentials and federated user info.

Decode an encoded authorization failure message. Args: - encodedMessage: The encoded message from an authorization failure (required) When an AWS API call fails due to authorization, AWS sometimes returns an encoded message. This operation decodes that message to show the details of what failed. Returns the decoded authorization message as JSON.