Discover AWS profile, region, and identity before deployment

This skill establishes the effective AWS profile, region, account, and caller identity before any AWS work, using only masked AWS CLI metadata - never opening or printing ~/.aws/credentials, credential-process output, secret environment variables, access keys, session tokens, or SSO token caches. It resolves the active profile from what the user explicitly named or from masked CLI metadata, surfacing clearly if a named profile is absent from aws configure list-profiles. It resolves region through a strict fallback order - a region the user explicitly named in conversation, then aws configure list --profile, then aws configure get region --profile - asking the user only after all of those fail, and never falling back to a hardcoded default like us-east-1. It then runs aws sts get-caller-identity to serve three purposes in one call: confirming credentials are valid (stopping if not), returning the account ID needed for ARN construction, and returning the caller's ARN. That ARN's pattern identifies the principal type and what IAM operations it can perform: a plain IAM user's IAM write capability depends on attached policies, an SSO assumed-role (assumed-role/AWSReservedSSO_...) typically has no IAM write capability at all, and a regular assumed-role depends on the role. The highest-leverage thing this skill does is surfacing an SSO caller immediately, before a later deployment skill hits iam:CreateRole and fails - turning what would be a confusing mid-deployment error into an upfront five-second conversation about needing an existing role instead. All results are meant to be remembered for the rest of the session rather than re-discovered.

Use it to establish the effective AWS profile, region, account, and caller before any AWS work, to diagnose expired SSO sessions, missing profiles, or configuration overrides, or to provide verified context to later SageMaker planning and deployment skills. Do NOT read AWS credential files, credential-process output, secret environment variables, or SSO token caches directly - use the masked metadata commands (aws configure list, aws configure get region, aws sts get-caller-identity) instead. Do NOT ask the user to confirm a region or profile value already read from their own configuration - that configuration is the confirmation.

Inputs: an optional user-named profile or region, and the AWS CLI's own configuration state. Outputs: a resolved profile, region, account ID, and caller ARN with its principal type identified (IAM user, SSO assumed-role, or regular assumed-role), reported back in one or two lines, plus an upfront warning if the caller is SSO-authenticated and likely can't create IAM roles.

aws sts get-caller-identity --profile "$profile" --region "$region"

Built entirely on the AWS CLI's metadata commands (aws configure list-profiles, aws configure list, aws configure get region, aws sts get-caller-identity), feeding verified context forward into later SageMaker planning and deployment skills.

Agents and engineers about to do AWS work who need to know their effective profile, region, account, and IAM capability before hitting a confusing permission error mid-deployment.