AWS

What it coversCopy Anchor Link

AWS fills infrastructure gaps when application telemetry is missing, delayed or weakly attributed. It can confirm load balancer 5xx responses, SQS backlog, ECS service events and CloudWatch log errors in a time window. For the age of the oldest queued message, read the AWS/SQS CloudWatch metric ApproximateAgeOfOldestMessage.

ConnectCopy Anchor Link

AWS accounts are usually separate per environment, so tie each connection to one:

reckon connect aws-prod --org acme --provider aws --for-env prod

Fill in ~/.reckon/orgs/acme/secrets/aws-prod.env with a read-only IAM identity:

AWS_REGION=ap-south-1
AWS_ACCESS_KEY_ID=replace_me
AWS_SECRET_ACCESS_KEY=replace_me

AWS_DEFAULT_REGION works instead of AWS_REGION. Add AWS_SESSION_TOKEN for temporary credentials, or set AWS_PROFILE to a profile defined in the connection's own AWS config. Instead of the file, you can run reckon login aws-prod in your own terminal: it runs aws configure against ~/.reckon/orgs/acme/config/aws-prod/aws/{config,credentials}, never your ~/.aws.

reckon verify aws-prod runs aws sts get-caller-identity --output json.

Read-only contractCopy Anchor Link

The AWS CLI has no read-only mode, so Reckon allows only a fixed list of operations reads: CloudWatch logs (filter-log-events, get-log-events, describe-log-groups, describe-log-streams, start-query, get-query-results), CloudWatch metrics and alarms, describe-* and list-* for ECS, ELB, EKS, EC2, RDS, Auto Scaling and ElastiCache, sqs get-queue-attributes and list-queues, cloudtrail lookup-events, route53 list-*, dynamodb describe-table and list-tables, lambda list-functions, sts get-caller-identity and s3 ls. Anything else is refused, including operations that return secrets or write files (s3api get-object). It also refuses --profile, --endpoint-url and --no-verify-ssl. The IAM policy remains the real write barrier.

Key commandsCopy Anchor Link

reckon run aws -- cloudwatch get-metric-statistics --namespace AWS/ApplicationELB --metric-name HTTPCode_Target_5XX_Count --dimensions Name=LoadBalancer,Value=<lb> --start-time <ISO> --end-time <ISO> --period 60 --statistics Sum --output json
reckon run aws -- sqs get-queue-attributes --queue-url <url> --attribute-names ApproximateNumberOfMessages ApproximateNumberOfMessagesNotVisible --output json
reckon run aws -- ecs describe-services --cluster <cluster> --services <service> --output json
reckon run aws -- logs filter-log-events --log-group-name <group> --start-time <epoch-ms> --end-time <epoch-ms> --filter-pattern '"ERROR"' --output json

LinksCopy Anchor Link

• AWS CLI User Guide