zuke.tools.aws

class AwsCloudformationDeleteStackSettings(AwsSettings)

• stack_name(name: str) -> Self

  The stack to delete (--stack-name).

• role_arn(arn: str) -> Self

  The role CloudFormation assumes to delete (--role-arn).

• retain_resources(*ids: str) -> Self

  Logical ids to keep when a delete is retried (--retain-resources).

class AwsCloudformationDeploySettings(AwsSettings)

• template_file(path: str) -> Self

  The template to deploy (--template-file).

• stack_name(name: str) -> Self

  The stack to create or update (--stack-name).

• parameter_override(key: str, value: str) -> Self

  Set a template parameter (--parameter-overrides Key=Value); repeatable.

• capabilities(*values: str) -> Self

  Acknowledge what the template creates (--capabilities), e.g. "CAPABILITY_IAM".

• tag(key: str, value: str) -> Self

  Tag the stack and its resources (--tags Key=Value); repeatable.

• no_execute_changeset() -> Self

  Create the change set without executing it (--no-execute-changeset).

• no_fail_on_empty_changeset() -> Self

  Exit 0 when there is nothing to change (--no-fail-on-empty-changeset).

• role_arn(arn: str) -> Self

  The role CloudFormation assumes to deploy (--role-arn).

• s3_bucket(name: str) -> Self

  The bucket a large template is uploaded to (--s3-bucket).

• s3_prefix(prefix: str) -> Self

  The key prefix for that upload (--s3-prefix).

• kms_key_id(id: str) -> Self

  The KMS key that encrypts that upload (--kms-key-id).

class AwsCloudformationDescribeStacksSettings(AwsSettings)

• stack_name(name: str) -> Self

  The stack to describe (--stack-name); every stack when omitted.

class AwsCloudformationWaitSettings(AwsSettings)

• waiter(name: Literal['stack-create-complete', 'stack-update-complete', 'stack-delete-complete', 'stack-import-complete', 'stack-rollback-complete', 'stack-exists']) -> Self

  The state to wait for, e.g. "stack-update-complete".

• stack_name(name: str) -> Self

  The stack to wait on (--stack-name).

class AwsCloudwatchDescribeAlarmsSettings(AwsSettings)

• alarm_names(*names: str) -> Self

  Only these alarms (--alarm-names); repeatable.

• alarm_name_prefix(prefix: str) -> Self

  Only alarms whose name starts with this (--alarm-name-prefix).

• state_value(state: Literal['OK', 'ALARM', 'INSUFFICIENT_DATA']) -> Self

  Only alarms in this state (--state-value).

• alarm_types(*types: Literal['MetricAlarm', 'CompositeAlarm', 'LogAlarm']) -> Self

  The kinds of alarm to return (--alarm-types): metric, composite or log alarms; replaces any set before. Without it the CLI returns metric alarms only.

class AwsCloudwatchExpressionSettings(Settings)

• label(text: str) -> Self

  A label for the series in the response.

• period(seconds: float) -> Self

  The period in seconds, for an expression that has no metric to take it from.

• return_data(value: bool) -> Self

  Whether the response carries this series (default true).

class AwsCloudwatchGetMetricDataSettings(AwsSettings)

• metric_stat(id: str, configure: Callable[[AwsCloudwatchMetricStatSettings], AwsCloudwatchMetricStatSettings]) -> Self

  Add a metric to the request, under id, configured by configure.

• expression(id: str, expression: str, configure: Callable[[AwsCloudwatchExpressionSettings], AwsCloudwatchExpressionSettings] | None=None) -> Self

  Add a metric-math expression over the request's other ids, e.g. ("ratio", "100 * errors / requests").

• start_time(time: str) -> Self

  The start of the range (--start-time).

• end_time(time: str) -> Self

  The end of the range (--end-time).

• window(duration: str | float, end: str | None=None) -> Self

  The duration ("15m", or milliseconds) up to end — now, unless given — as --start-time and --end-time.

• scan_by(order: Literal['TimestampDescending', 'TimestampAscending']) -> Self

  The order of the datapoints (--scan-by); newest first by default.

• max_datapoints(count: float) -> Self

  The most datapoints to return (--max-datapoints). Setting it turns off the CLI's automatic pagination — the CLI treats it as a page size and returns one page with a NextToken — so the answer may hold only part of the window. AwsTasks.metricValue refuses it for that reason.

class AwsCloudwatchGetMetricStatisticsSettings(AwsSettings)

• namespace(value: str) -> Self

  The metric's namespace (--namespace).

• metric_name(value: str) -> Self

  The metric's name (--metric-name).

• dimension(name: str, value: str) -> Self

  A dimension that picks the series (--dimensions); repeatable.

• start_time(time: str) -> Self

  The start of the range (--start-time).

• end_time(time: str) -> Self

  The end of the range (--end-time).

• window(duration: str | float, end: str | None=None) -> Self

  The duration up to end — now, unless given — as the time range.

• period(seconds: float) -> Self

  The aggregation period in seconds (--period).

• statistics(*values: Literal['SampleCount', 'Average', 'Sum', 'Minimum', 'Maximum']) -> Self

  The basic statistics to return (--statistics), e.g. "Sum".

• extended_statistics(*values: str) -> Self

  Percentiles and other extended statistics (--extended-statistics), e.g. "p99".

• unit(value: str) -> Self

  Only datapoints published in this unit (--unit).

class AwsCloudwatchMetricStatSettings(Settings)

• namespace(value: str) -> Self

  The metric's namespace, e.g. "AWS/ApplicationELB".

• metric_name(value: str) -> Self

  The metric's name, e.g. "HTTPCode_Target_5XX_Count".

• dimension(name: str, value: str) -> Self

  A dimension that picks the series, e.g. ("LoadBalancer", "app/web/1f2e"); repeatable.

• period(seconds: float) -> Self

  The aggregation period in seconds (default 60). CloudWatch accepts 1, 5, 10, 20, 30, or a multiple of 60.

• stat(value: Literal['SampleCount', 'Average', 'Sum', 'Minimum', 'Maximum', 'IQM']) -> Self

  The statistic: "Sum", "Average", "Maximum", "p99", …

• unit(value: str) -> Self

  Only datapoints published in this unit, e.g. "Count".

• label(text: str) -> Self

  A label for the series in the response.

• return_data(value: bool) -> Self

  Whether the response carries this series (default true). Pass false for a metric that only feeds an expression.

class AwsCloudwatchMetricValueSettings(AwsCloudwatchGetMetricDataSettings)

• id(query_id: str) -> Self

  The series to read, by query id. Needed only when the request returns more than one — hide the inputs of an expression with .returnData(false) and it is not.

• aggregate(how: Literal['latest', 'sum', 'average', 'maximum', 'minimum']) -> Self

  How to turn the series into one number (default "latest", the newest datapoint). An aggregate combines the datapoints the window holds: a "sum" of per-minute Sums is the window's total.

• missing_data_as(value: float) -> Self

  Return value when the series has no datapoints, instead of failing. CloudWatch publishes nothing for a period with no events, so for a count of errors, no data does mean 0; for a latency or a CPU reading it usually means the query is looking in the wrong place.

class AwsConfigureGetSettings(AwsSettings)

• varname(name: str) -> Self

  The setting to read (positional), e.g. "region".

class AwsConfigureSetSettings(AwsSettings)

• varname(name: str) -> Self

  The setting to write (positional), e.g. "region".

• value(text: str) -> Self

  The value to write (positional).

class AwsEcrBatchDeleteImageSettings(AwsSettings)

• repository_name(name: str) -> Self

  The repository to delete from (--repository-name).

• registry_id(id: str) -> Self

  The registry's account id, when not the caller's (--registry-id).

• image_tag(tag: str) -> Self

  Delete the image with this tag (--image-ids); repeatable.

• image_digest(digest: str) -> Self

  Delete the image with this digest (--image-ids); repeatable.

class AwsEcrDescribeImagesSettings(AwsSettings)

• repository_name(name: str) -> Self

  The repository to describe (--repository-name).

• registry_id(id: str) -> Self

  The registry's account id, when not the caller's (--registry-id).

• image_tag(tag: str) -> Self

  Describe the image with this tag (--image-ids); repeatable.

• image_digest(digest: str) -> Self

  Describe the image with this digest (--image-ids); repeatable.

• tag_status(status: Literal['TAGGED', 'UNTAGGED', 'ANY']) -> Self

  Only images with this tag status (--filter tagStatus=…).

class AwsEcrDescribeRepositoriesSettings(AwsSettings)

• repository_names(*names: str) -> Self

  Only these repositories (--repository-names); all when omitted.

• registry_id(id: str) -> Self

  The registry's account id, when not the caller's (--registry-id).

class AwsEcrGetLoginPasswordSettings(AwsSettings)

class AwsEcsDescribeServicesSettings(AwsSettings)

• cluster(name: str) -> Self

  The cluster the services run in (--cluster).

• services(*names: str) -> Self

  The services to describe (--services); repeatable.

class AwsEcsRegisterTaskDefinitionSettings(AwsSettings)

• cli_input_json(value: str) -> Self

  The whole request as JSON (--cli-input-json): a file:// path to the document, or the document itself.

• family(name: str) -> Self

  The task definition family (--family).

• container_definitions(json: str) -> Self

  The container definitions, as a JSON array or a file:// path (--container-definitions).

• task_role_arn(arn: str) -> Self

  The role the task's containers assume (--task-role-arn).

• execution_role_arn(arn: str) -> Self

  The role ECS uses to pull images and read secrets (--execution-role-arn).

• network_mode(mode: str) -> Self

  The Docker networking mode (--network-mode), e.g. "awsvpc".

• requires_compatibilities(*types: str) -> Self

  The launch types the definition must suit (--requires-compatibilities).

• cpu(value: str) -> Self

  CPU units for the task (--cpu), e.g. "256".

• memory(value: str) -> Self

  Memory for the task in MiB (--memory), e.g. "512".

class AwsEcsRunTaskSettings(AwsSettings)

• cluster(name: str) -> Self

  The cluster to run the task in (--cluster).

• task_definition(value: str) -> Self

  The task definition to run (--task-definition).

• count(value: float) -> Self

  How many copies to start (--count).

• launch_type(value: str) -> Self

  The launch type (--launch-type): "FARGATE", "EC2" or "EXTERNAL".

• network_configuration(json: str) -> Self

  The awsvpc network configuration, as JSON (--network-configuration).

• overrides(json: str) -> Self

  Container overrides, as JSON (--overrides).

• started_by(value: str) -> Self

  A label for who started the task (--started-by).

• group(name: str) -> Self

  The task group name (--group).

class AwsEcsUpdateServiceSettings(AwsSettings)

• cluster(name: str) -> Self

  The cluster the service runs in (--cluster); the default cluster when omitted.

• service(name: str) -> Self

  The service to update (--service).

• task_definition(value: str) -> Self

  The task definition to run, as family:revision or an ARN (--task-definition).

• desired_count(count: float) -> Self

  How many tasks to keep running (--desired-count).

• force_new_deployment() -> Self

  Start a new deployment even when nothing changed (--force-new-deployment).

• health_check_grace_period_seconds(seconds: float) -> Self

  Seconds to ignore failing health checks after a task starts (--health-check-grace-period-seconds).

class AwsEcsWaitServicesStableSettings(AwsSettings)

• cluster(name: str) -> Self

  The cluster the services run in (--cluster).

• services(*names: str) -> Self

  The services to wait for (--services); repeatable.

class AwsEksDescribeClusterSettings(AwsSettings)

• name(cluster: str) -> Self

  The cluster (--name).

class AwsEksUpdateKubeconfigSettings(AwsSettings)

• name(cluster: str) -> Self

  The cluster (--name).

• kubeconfig(path: str) -> Self

  The kubeconfig file to write (--kubeconfig); ~/.kube/config by default.

• alias(name: str) -> Self

  The context's name (--alias); the cluster ARN by default.

• user_alias(name: str) -> Self

  The user entry's name (--user-alias).

• role_arn(arn: str) -> Self

  A role to assume when authenticating to the cluster (--role-arn).

• dry_run() -> Self

  Print the configuration instead of writing it (--dry-run).

class AwsLambdaGetAliasSettings(AwsSettings)

• function_name(name: str) -> Self

  The function's name or ARN (--function-name).

• name(alias: str) -> Self

  The alias to describe (--name), e.g. "live".

class AwsLambdaGetFunctionSettings(AwsSettings)

• function_name(name: str) -> Self

  The function's name or ARN (--function-name).

• qualifier(value: str) -> Self

  A version or alias to describe instead of $LATEST (--qualifier).

class AwsLambdaInvokeSettings(AwsSettings)

• function_name(name: str) -> Self

  The function's name or ARN (--function-name).

• payload(json: str) -> Self

  The event to send, as JSON text (--payload). AWS CLI v2 reads a payload as base64 unless told otherwise, so this also passes --cli-binary-format raw-in-base64-out to send the text as it is.

• invocation_type(value: Literal['RequestResponse', 'Event', 'DryRun']) -> Self

  Wait for the response, queue the event, or only check access (--invocation-type).

• log_type(value: Literal['None', 'Tail']) -> Self

  "Tail" returns the last 4 KB of the execution log, base64-encoded (--log-type).

• qualifier(value: str) -> Self

  A version or alias to invoke (--qualifier).

• outfile(path: str) -> Self

  The file the function's response is written to (positional).

class AwsLambdaPublishVersionSettings(AwsSettings)

• function_name(name: str) -> Self

  The function's name or ARN (--function-name).

• description(text: str) -> Self

  A description of the version (--description).

• code_sha256(hash: str) -> Self

  Publish only if the code still has this SHA-256 (--code-sha256).

• revision_id(id: str) -> Self

  Publish only if the function is still at this revision (--revision-id).

class AwsLambdaUpdateAliasSettings(AwsSettings)

• function_name(name: str) -> Self

  The function's name or ARN (--function-name).

• name(alias: str) -> Self

  The alias to move (--name), e.g. "live".

• function_version(version: str) -> Self

  The version the alias points at (--function-version).

• description(text: str) -> Self

  A description of the alias (--description).

• additional_version_weight(version: str, weight: float) -> Self

  Send a share of the alias's traffic to another version (--routing-config AdditionalVersionWeights), as a fraction from 0 to 1; repeatable. The rest goes to functionVersion.

• revision_id(id: str) -> Self

  Update only if the alias is still at this revision (--revision-id) — the RevisionId a get-alias read, so a change made in between fails the update instead of being overwritten.

• clear_routing() -> Self

  Clear the alias's weighted routing, sending all traffic to its version (--routing-config with no additional weights).

class AwsLambdaUpdateFunctionCodeSettings(AwsSettings)

• function_name(name: str) -> Self

  The function's name or ARN (--function-name).

• zip_file(path: str) -> Self

  The deployment package on disk (--zip-file). The CLI reads the file when the path carries its fileb:// prefix, which this adds unless the path already has it.

• s3_bucket(name: str) -> Self

  The bucket holding the deployment package (--s3-bucket).

• s3_key(key: str) -> Self

  The package's key in that bucket (--s3-key).

• s3_object_version(version: str) -> Self

  The package object's version (--s3-object-version).

• image_uri(uri: str) -> Self

  The container image, for an image-packaged function (--image-uri).

• publish() -> Self

  Publish a new version once the code is updated (--publish).

• dry_run() -> Self

  Validate the request without updating the function (--dry-run).

• revision_id(id: str) -> Self

  Update only if the function is still at this revision (--revision-id).

• architectures(*values: str) -> Self

  The instruction set architectures (--architectures), e.g. "arm64".

class AwsLambdaUpdateFunctionConfigurationSettings(AwsSettings)

• function_name(name: str) -> Self

  The function's name or ARN (--function-name).

• environment(variables: Mapping[str, str]) -> Self

  The function's environment variables (--environment). This replaces the whole set — a variable left out is removed — and the values travel on the command line, so keep secrets in Secrets Manager or SSM and pass their names instead.

• timeout(seconds: float) -> Self

  The longest an invocation may run, in seconds (--timeout).

• memory_size(mib: float) -> Self

  Memory for the function in MiB (--memory-size).

• handler(name: str) -> Self

  The handler entry point (--handler), e.g. "index.handler".

• runtime(name: str) -> Self

  The runtime (--runtime), e.g. "nodejs22.x".

• role(arn: str) -> Self

  The execution role's ARN (--role).

• description(text: str) -> Self

  A description of the function (--description).

• layers(*arns: str) -> Self

  The layers to attach, by version ARN (--layers); replaces the set.

class AwsLambdaWaitSettings(AwsSettings)

• waiter(name: Literal['function-active', 'function-active-v2', 'function-exists', 'function-updated', 'function-updated-v2', 'published-version-active']) -> Self

  The state to wait for, e.g. "published-version-active".

• function_name(name: str) -> Self

  The function's name or ARN (--function-name).

• qualifier(value: str) -> Self

  The version or alias to wait on (--qualifier).

class AwsLogsFilterLogEventsSettings(AwsSettings)

• log_group_name(name: str) -> Self

  The log group to search (--log-group-name).

• log_stream_names(*names: str) -> Self

  Only these streams (--log-stream-names); repeatable.

• log_stream_name_prefix(prefix: str) -> Self

  Only streams whose name starts with this (--log-stream-name-prefix).

• filter_pattern(pattern: str) -> Self

  A CloudWatch Logs filter pattern (--filter-pattern), e.g. "ERROR".

• start_time(time: str) -> Self

  The start of the range (--start-time, sent as epoch milliseconds).

• end_time(time: str) -> Self

  The end of the range (--end-time, sent as epoch milliseconds).

• window(duration: str | float, end: str | None=None) -> Self

  The duration up to end — now, unless given — as the time range.

class AwsLogsGetQueryResultsSettings(AwsSettings)

• query_id(id: str) -> Self

  The id start-query returned (--query-id).

• next_token(token: str) -> Self

  The page after the one that returned this token (--next-token).

class AwsLogsInsightsQuerySettings(Settings)

• log_group_names(*names: str) -> Self

  The log groups to query (--log-group-names); repeatable.

• query_string(query: str) -> Self

  The Logs Insights query (--query-string).

• start_time(time: str) -> Self

  The start of the range.

• end_time(time: str) -> Self

  The end of the range.

• window(duration: str | float, end: str | None=None) -> Self

  The duration up to end — now, unless given — as the time range.

• limit(rows: float) -> Self

  The most rows to return (--limit).

• timeout(duration: str | float) -> Self

  How long to wait for the query to finish ("2m", or ms; default 5 minutes). A query still running then is stopped, and the reader fails.

• poll_interval(duration: str | float) -> Self

  The pause between polls for the results ("2s", or ms; default 1 second).

• aws(configure: Callable[[AwsSettings], AwsSettings]) -> Self

  Global options for every command the query runs — (a) => a.profile("prod").region("eu-west-1"), a .toolPath(...), or a .runner(...).

class AwsLogsStartQuerySettings(AwsSettings)

• log_group_names(*names: str) -> Self

  The log groups to query (--log-group-names); repeatable.

• query_string(query: str) -> Self

  The Logs Insights query (--query-string).

• start_time(time: str) -> Self

  The start of the range (--start-time, sent as epoch seconds).

• end_time(time: str) -> Self

  The end of the range (--end-time, sent as epoch seconds).

• window(duration: str | float, end: str | None=None) -> Self

  The duration up to end — now, unless given — as the time range.

• limit(rows: float) -> Self

  The most rows to return (--limit).

class AwsLogsStopQuerySettings(AwsSettings)

• query_id(id: str) -> Self

  The id start-query returned (--query-id).

class AwsLogsTailSettings(AwsSettings)

• group_name(name: str) -> Self

  The log group to tail (positional).

• since(value: str) -> Self

  How far back to start (--since), e.g. "10m" or an ISO timestamp.

• follow() -> Self

  Keep printing new events as they arrive (--follow).

• filter_pattern(pattern: str) -> Self

  A CloudWatch Logs filter pattern (--filter-pattern).

• format(value: Literal['detailed', 'short', 'json']) -> Self

  How each event is printed (--format).

• log_stream_names(*names: str) -> Self

  Only these streams (--log-stream-names); repeatable.

• log_stream_name_prefix(prefix: str) -> Self

  Only streams whose name starts with this (--log-stream-name-prefix).

class AwsS3CpSettings(AwsSettings)

• source(path: str) -> Self

  The local path or s3:// URI to copy from (positional).

• destination(path: str) -> Self

  The local path or s3:// URI to copy to (positional).

• recursive() -> Self

  Copy every file under a directory or prefix (--recursive).

• exclude(pattern: str) -> Self

  Skip files matching the pattern (--exclude); repeatable, order kept.

• include(pattern: str) -> Self

  Copy files matching the pattern despite an earlier exclude (--include).

• dryrun() -> Self

  Print what would be copied without copying it (--dryrun).

• acl(value: str) -> Self

  A canned ACL for the uploaded objects (--acl), e.g. "private".

• content_type(value: str) -> Self

  The uploaded objects' content type (--content-type).

• cache_control(value: str) -> Self

  The uploaded objects' Cache-Control (--cache-control).

• storage_class(value: str) -> Self

  The storage class for the uploaded objects (--storage-class).

• sse(value: str) -> Self

  Server-side encryption (--sse): "AES256" or "aws:kms".

• sse_kms_key_id(id: str) -> Self

  The KMS key for aws:kms server-side encryption (--sse-kms-key-id).

• only_show_errors() -> Self

  Print only errors and warnings (--only-show-errors).

• no_progress() -> Self

  Leave out the file-transfer progress lines (--no-progress).

class AwsS3LsSettings(AwsSettings)

• path(uri: str) -> Self

  The s3:// URI to list (positional); the buckets when omitted.

• recursive() -> Self

  List every object under the prefix (--recursive).

• human_readable() -> Self

  Print sizes as KiB, MiB, … (--human-readable).

• summarize() -> Self

  Print the object count and total size (--summarize).

class AwsS3MbSettings(AwsSettings)

• bucket(uri: str) -> Self

  The bucket to make, as an s3:// URI (positional).

class AwsS3PresignSettings(AwsSettings)

• path(uri: str) -> Self

  The s3:// object to presign (positional).

• expires_in(seconds: float) -> Self

  How long the URL stays valid, in seconds (--expires-in; default 3600).

class AwsS3RmSettings(AwsSettings)

• path(uri: str) -> Self

  The s3:// object or prefix to remove (positional).

• recursive() -> Self

  Remove every object under the prefix (--recursive).

• exclude(pattern: str) -> Self

  Keep objects matching the pattern (--exclude); repeatable, order kept.

• include(pattern: str) -> Self

  Remove objects matching the pattern despite an earlier exclude (--include).

• dryrun() -> Self

  Print what would be removed without removing it (--dryrun).

class AwsS3SyncSettings(AwsSettings)

• source(path: str) -> Self

  The local directory or s3:// prefix to sync from (positional).

• destination(path: str) -> Self

  The local directory or s3:// prefix to sync to (positional).

• delete() -> Self

  Delete files at the destination that the source does not have (--delete), which makes the destination a mirror rather than a superset.

• exclude(pattern: str) -> Self

  Skip files matching the pattern (--exclude); repeatable, order kept.

• include(pattern: str) -> Self

  Sync files matching the pattern despite an earlier exclude (--include).

• dryrun() -> Self

  Print what would change without changing it (--dryrun).

• exact_timestamps() -> Self

  Treat same-size files with different timestamps as changed (--exact-timestamps).

• size_only() -> Self

  Compare by size alone, ignoring timestamps (--size-only).

• acl(value: str) -> Self

  A canned ACL for the uploaded objects (--acl).

• content_type(value: str) -> Self

  The uploaded objects' content type (--content-type).

• cache_control(value: str) -> Self

  The uploaded objects' Cache-Control (--cache-control).

• storage_class(value: str) -> Self

  The storage class for the uploaded objects (--storage-class).

• only_show_errors() -> Self

  Print only errors and warnings (--only-show-errors).

• no_progress() -> Self

  Leave out the file-transfer progress lines (--no-progress).

class AwsSecretsmanagerGetSecretValueSettings(AwsSettings)

• secret_id(id: str) -> Self

  The secret's name or ARN (--secret-id).

• version_id(id: str) -> Self

  A specific version, by id (--version-id).

• version_stage(label: str) -> Self

  A specific version, by staging label (--version-stage); AWSCURRENT by default.

class AwsSettings(SubcommandSettings)

• profile(name: str) -> Self

  The named profile from the shared config and credentials files (--profile).

• region(name: str) -> Self

  The AWS Region to send the request to (--region), e.g. "eu-west-1".

• output(format: Literal['json', 'text', 'table', 'yaml', 'yaml-stream', 'off']) -> Self

  The output format (--output): json, text, table, yaml or yaml-stream.

• query(expression: str) -> Self

  A JMESPath expression that filters the response (--query).

• endpoint_url(url: str) -> Self

  Send the request to this URL instead of the service's default endpoint (--endpoint-url).

• no_cli_pager() -> Self

  Pass --no-cli-pager explicitly. The pager is already off through AWS_PAGER (see AwsSettings); the flag is for a build that wants it on the command line as well. AWS CLI v2 only.

• no_verify_ssl() -> Self

  Skip TLS certificate verification (--no-verify-ssl). This disables the check that the endpoint is who it claims to be — meant for a local emulator, never for a real account; prefer caBundle.

• no_sign_request() -> Self

  Send the request unsigned, without loading credentials (--no-sign-request).

• ca_bundle(path: str) -> Self

  The CA certificate bundle to verify TLS against (--ca-bundle).

• cli_read_timeout(seconds: float) -> Self

  The socket read timeout in seconds; 0 blocks forever (--cli-read-timeout).

• cli_connect_timeout(seconds: float) -> Self

  The socket connect timeout in seconds; 0 blocks forever (--cli-connect-timeout).

• debug() -> Self

  Turn on the CLI's debug logging (--debug), written to stderr. The debug log carries credentials: request headers with the session token, and response bodies — a secret's value among them. The access key, secret key and session token in the environment are registered with the run's redactor when this is called, but a credential the CLI loads from a profile, an SSO cache or a role is not known here and is not masked. Keep it for a local investigation, never a shared CI log.

• flag(name: str, value: str | float | None=None) -> Self

  Add an arbitrary option: --name value, or the bare --name. Two hazards come with the escape hatch, which the typed setters guard and this does not: a value that starts with - is read by the CLI as the next option, and a value that starts with file:// or fileb:// is replaced by that file's contents — which then leave the machine in the request. Never pass an untrusted value here.

class AwsSsmGetParameterSettings(AwsSettings)

• name(value: str) -> Self

  The parameter's name or ARN (--name).

• with_decryption() -> Self

  Return a SecureString decrypted (--with-decryption). Without it, a SecureString comes back as ciphertext.

class AwsSsmPutParameterSettings(AwsSettings)

• name(value: str) -> Self

  The parameter's name (--name).

• value(text: str) -> Self

  The value, given literally (--value). Refuses a value starting with file:// or fileb://: the CLI would read the named file rather than store the text — use valueFile when that is the intent.

• value_file(path: str) -> Self

  Read the value from a file (--value=file://<path>), which keeps it off the command line. The CLI stores the file's contents exactly, trailing newline included.

• type_(value: Literal['String', 'StringList', 'SecureString']) -> Self

  The parameter's type (--type).

• overwrite() -> Self

  Replace an existing parameter (--overwrite).

• key_id(id: str) -> Self

  The KMS key that encrypts a SecureString (--key-id).

• description(text: str) -> Self

  A description of the parameter (--description).

• tier(value: Literal['Standard', 'Advanced', 'Intelligent-Tiering']) -> Self

  The storage tier (--tier).

• data_type(value: str) -> Self

  The data type (--data-type), e.g. "aws:ec2:image".

class AwsStsAssumeRoleSettings(AwsSettings)

• role_arn(arn: str) -> Self

  The role to assume (--role-arn).

• role_session_name(name: str) -> Self

  An identifier for the session, shown in CloudTrail (--role-session-name).

• duration_seconds(seconds: float) -> Self

  How long the credentials last, in seconds (--duration-seconds).

• external_id(id: str) -> Self

  The external id the role's trust policy requires (--external-id).

• policy(json: str) -> Self

  An inline session policy, as a JSON document (--policy).

• serial_number(serial: str) -> Self

  The MFA device's serial number or ARN (--serial-number).

• token_code(code: str) -> Self

  The code the MFA device shows (--token-code).

class AwsStsGetCallerIdentitySettings(AwsSettings)

class AwsTasks

• static async run(ctx: ServiceContext, configure: Callable[[AwsSettings], AwsSettings] | None=None) -> ExecResult

  Run any aws command, built with .command(service, operation, …).

• static async sts_get_caller_identity(ctx: ServiceContext, configure: Callable[[AwsStsGetCallerIdentitySettings], AwsStsGetCallerIdentitySettings] | None=None) -> ExecResult

  Who the build runs as: aws sts get-caller-identity.

• static async account_id(ctx: ServiceContext, configure: Callable[[AwsStsGetCallerIdentitySettings], AwsStsGetCallerIdentitySettings] | None=None) -> object

  The AWS account id the build runs as, read back as a string. Pins --query Account --output text.

• static async sts_assume_role(ctx: ServiceContext, configure: Callable[[AwsStsAssumeRoleSettings], AwsStsAssumeRoleSettings] | None=None) -> ExecResult

  Take on a role's temporary credentials: aws sts assume-role (captured, never streamed).

• static async configure_get(ctx: ServiceContext, configure: Callable[[AwsConfigureGetSettings], AwsConfigureGetSettings] | None=None) -> ExecResult

  Read a CLI setting: aws configure get.

• static async configure_set(ctx: ServiceContext, configure: Callable[[AwsConfigureSetSettings], AwsConfigureSetSettings] | None=None) -> ExecResult

  Write a CLI setting: aws configure set.

• static async s3_cp(ctx: ServiceContext, configure: Callable[[AwsS3CpSettings], AwsS3CpSettings] | None=None) -> ExecResult

  Copy a file or tree to, from or within S3: aws s3 cp.

• static async s3_sync(ctx: ServiceContext, configure: Callable[[AwsS3SyncSettings], AwsS3SyncSettings] | None=None) -> ExecResult

  Sync a tree to, from or within S3: aws s3 sync.

• static async s3_ls(ctx: ServiceContext, configure: Callable[[AwsS3LsSettings], AwsS3LsSettings] | None=None) -> ExecResult

  List buckets or objects: aws s3 ls.

• static async s3_rm(ctx: ServiceContext, configure: Callable[[AwsS3RmSettings], AwsS3RmSettings] | None=None) -> ExecResult

  Remove objects: aws s3 rm.

• static async s3_mb(ctx: ServiceContext, configure: Callable[[AwsS3MbSettings], AwsS3MbSettings] | None=None) -> ExecResult

  Make a bucket: aws s3 mb.

• static async s3_presign(ctx: ServiceContext, configure: Callable[[AwsS3PresignSettings], AwsS3PresignSettings] | None=None) -> ExecResult

  Print a presigned URL for an object: aws s3 presign.

• static async ecr_get_login_password(ctx: ServiceContext, configure: Callable[[AwsEcrGetLoginPasswordSettings], AwsEcrGetLoginPasswordSettings] | None=None) -> ExecResult

  Print a registry password: aws ecr get-login-password (captured, never streamed).

• static async ecr_login_password(ctx: ServiceContext, configure: Callable[[AwsEcrGetLoginPasswordSettings], AwsEcrGetLoginPasswordSettings] | None=None) -> object

  The ECR registry password, read back as a string, for docker login --password-stdin.

• static async ecr_describe_images(ctx: ServiceContext, configure: Callable[[AwsEcrDescribeImagesSettings], AwsEcrDescribeImagesSettings] | None=None) -> ExecResult

  Describe a repository's images: aws ecr describe-images.

• static async ecr_describe_repositories(ctx: ServiceContext, configure: Callable[[AwsEcrDescribeRepositoriesSettings], AwsEcrDescribeRepositoriesSettings] | None=None) -> ExecResult

  Describe repositories: aws ecr describe-repositories.

• static async ecr_batch_delete_image(ctx: ServiceContext, configure: Callable[[AwsEcrBatchDeleteImageSettings], AwsEcrBatchDeleteImageSettings] | None=None) -> ExecResult

  Delete images: aws ecr batch-delete-image.

• static async ecs_update_service(ctx: ServiceContext, configure: Callable[[AwsEcsUpdateServiceSettings], AwsEcsUpdateServiceSettings] | None=None) -> ExecResult

  Roll a service onto a task definition: aws ecs update-service.

• static async ecs_describe_services(ctx: ServiceContext, configure: Callable[[AwsEcsDescribeServicesSettings], AwsEcsDescribeServicesSettings] | None=None) -> ExecResult

  Describe services: aws ecs describe-services.

• static async ecs_wait_services_stable(ctx: ServiceContext, configure: Callable[[AwsEcsWaitServicesStableSettings], AwsEcsWaitServicesStableSettings] | None=None) -> ExecResult

  Block until services are stable: aws ecs wait services-stable.

• static async ecs_register_task_definition(ctx: ServiceContext, configure: Callable[[AwsEcsRegisterTaskDefinitionSettings], AwsEcsRegisterTaskDefinitionSettings] | None=None) -> ExecResult

  Register a task definition: aws ecs register-task-definition.

• static async ecs_run_task(ctx: ServiceContext, configure: Callable[[AwsEcsRunTaskSettings], AwsEcsRunTaskSettings] | None=None) -> ExecResult

  Start a one-off task: aws ecs run-task.

• static async lambda_update_function_code(ctx: ServiceContext, configure: Callable[[AwsLambdaUpdateFunctionCodeSettings], AwsLambdaUpdateFunctionCodeSettings] | None=None) -> ExecResult

  Ship new code: aws lambda update-function-code.

• static async lambda_update_function_configuration(ctx: ServiceContext, configure: Callable[[AwsLambdaUpdateFunctionConfigurationSettings], AwsLambdaUpdateFunctionConfigurationSettings] | None=None) -> ExecResult

  Change a function's settings: aws lambda update-function-configuration.

• static async lambda_publish_version(ctx: ServiceContext, configure: Callable[[AwsLambdaPublishVersionSettings], AwsLambdaPublishVersionSettings] | None=None) -> ExecResult

  Publish a version: aws lambda publish-version.

• static async lambda_published_version(ctx: ServiceContext, configure: Callable[[AwsLambdaPublishVersionSettings], AwsLambdaPublishVersionSettings] | None=None) -> object

  Publish a new version of the function — aws lambda publish-version, which changes the account — and return the number it was given. Pins --query Version --output text. Not a lookup: every call publishes.

• static async lambda_update_alias(ctx: ServiceContext, configure: Callable[[AwsLambdaUpdateAliasSettings], AwsLambdaUpdateAliasSettings] | None=None) -> ExecResult

  Move an alias: aws lambda update-alias.

• static async lambda_get_alias(ctx: ServiceContext, configure: Callable[[AwsLambdaGetAliasSettings], AwsLambdaGetAliasSettings] | None=None) -> ExecResult

  Describe an alias: aws lambda get-alias.

• static async lambda_get_function(ctx: ServiceContext, configure: Callable[[AwsLambdaGetFunctionSettings], AwsLambdaGetFunctionSettings] | None=None) -> ExecResult

  Describe a function: aws lambda get-function.

• static async lambda_wait(ctx: ServiceContext, configure: Callable[[AwsLambdaWaitSettings], AwsLambdaWaitSettings] | None=None) -> ExecResult

  Wait for a function or version to reach a state: aws lambda wait.

• static async lambda_invoke(ctx: ServiceContext, configure: Callable[[AwsLambdaInvokeSettings], AwsLambdaInvokeSettings] | None=None) -> ExecResult

  Invoke a function: aws lambda invoke.

• static async cloudformation_deploy(ctx: ServiceContext, configure: Callable[[AwsCloudformationDeploySettings], AwsCloudformationDeploySettings] | None=None) -> ExecResult

  Create or update a stack: aws cloudformation deploy.

• static async cloudformation_describe_stacks(ctx: ServiceContext, configure: Callable[[AwsCloudformationDescribeStacksSettings], AwsCloudformationDescribeStacksSettings] | None=None) -> ExecResult

  Describe stacks: aws cloudformation describe-stacks.

• static async stack_output(ctx: ServiceContext, stack: str, key: str, configure: Callable[[AwsCloudformationDescribeStacksSettings], AwsCloudformationDescribeStacksSettings] | None=None) -> object

  One output of a stack, read back as a string. Pins a --query projecting that output and --output json; fails when the stack has no such output.

• static async cloudformation_delete_stack(ctx: ServiceContext, configure: Callable[[AwsCloudformationDeleteStackSettings], AwsCloudformationDeleteStackSettings] | None=None) -> ExecResult

  Delete a stack: aws cloudformation delete-stack.

• static async cloudformation_wait(ctx: ServiceContext, configure: Callable[[AwsCloudformationWaitSettings], AwsCloudformationWaitSettings] | None=None) -> ExecResult

  Block until a stack reaches a state: aws cloudformation wait <waiter>.

• static async secretsmanager_get_secret_value(ctx: ServiceContext, configure: Callable[[AwsSecretsmanagerGetSecretValueSettings], AwsSecretsmanagerGetSecretValueSettings] | None=None) -> ExecResult

  Read a secret: aws secretsmanager get-secret-value (captured, never streamed).

• static async secret_string(ctx: ServiceContext, configure: Callable[[AwsSecretsmanagerGetSecretValueSettings], AwsSecretsmanagerGetSecretValueSettings] | None=None) -> object

  A secret's SecretString, read back exactly — multi-line values and surrounding whitespace included. Pins --query SecretString --output json; fails for a binary secret.

• static async ssm_get_parameter(ctx: ServiceContext, configure: Callable[[AwsSsmGetParameterSettings], AwsSsmGetParameterSettings] | None=None) -> ExecResult

  Read a parameter: aws ssm get-parameter (captured, never streamed).

• static async parameter_value(ctx: ServiceContext, configure: Callable[[AwsSsmGetParameterSettings], AwsSsmGetParameterSettings] | None=None) -> object

  A parameter's value, read back exactly. Pins --query Parameter.Value --output json; add .withDecryption() for a SecureString.

• static async ssm_put_parameter(ctx: ServiceContext, configure: Callable[[AwsSsmPutParameterSettings], AwsSsmPutParameterSettings] | None=None) -> ExecResult

  Write a parameter: aws ssm put-parameter.

• static async eks_update_kubeconfig(ctx: ServiceContext, configure: Callable[[AwsEksUpdateKubeconfigSettings], AwsEksUpdateKubeconfigSettings] | None=None) -> ExecResult

  Write a kubeconfig entry for a cluster: aws eks update-kubeconfig.

• static async eks_describe_cluster(ctx: ServiceContext, configure: Callable[[AwsEksDescribeClusterSettings], AwsEksDescribeClusterSettings] | None=None) -> ExecResult

  Describe a cluster: aws eks describe-cluster.

• static async cloudwatch_get_metric_data(ctx: ServiceContext, configure: Callable[[AwsCloudwatchGetMetricDataSettings], AwsCloudwatchGetMetricDataSettings] | None=None) -> ExecResult

  Read metric datapoints: aws cloudwatch get-metric-data.

• static async metric_value(ctx: ServiceContext, configure: Callable[[AwsCloudwatchMetricValueSettings], AwsCloudwatchMetricValueSettings]) -> object

  One number from CloudWatch: the latest datapoint of a series, or an aggregate over the window. Pins --query MetricDataResults --output json; fails on no data unless .missingDataAs(value) says what it means.

• static async cloudwatch_get_metric_statistics(ctx: ServiceContext, configure: Callable[[AwsCloudwatchGetMetricStatisticsSettings], AwsCloudwatchGetMetricStatisticsSettings] | None=None) -> ExecResult

  Read metric statistics: aws cloudwatch get-metric-statistics.

• static async cloudwatch_describe_alarms(ctx: ServiceContext, configure: Callable[[AwsCloudwatchDescribeAlarmsSettings], AwsCloudwatchDescribeAlarmsSettings] | None=None) -> ExecResult

  Describe alarms: aws cloudwatch describe-alarms.

• static async alarm_state(ctx: ServiceContext, name: str, configure: Callable[[AwsCloudwatchDescribeAlarmsSettings], AwsCloudwatchDescribeAlarmsSettings] | None=None) -> object

  The state of one metric, composite or log alarm: OK, ALARM or INSUFFICIENT_DATA.

• static async logs_start_query(ctx: ServiceContext, configure: Callable[[AwsLogsStartQuerySettings], AwsLogsStartQuerySettings] | None=None) -> ExecResult

  Start a Logs Insights query: aws logs start-query.

• static async logs_get_query_results(ctx: ServiceContext, configure: Callable[[AwsLogsGetQueryResultsSettings], AwsLogsGetQueryResultsSettings] | None=None) -> ExecResult

  Read a Logs Insights query's results: aws logs get-query-results.

• static async logs_stop_query(ctx: ServiceContext, configure: Callable[[AwsLogsStopQuerySettings], AwsLogsStopQuerySettings] | None=None) -> ExecResult

  Stop a running Logs Insights query: aws logs stop-query.

• static async logs_insights_query(ctx: ServiceContext, configure: Callable[[AwsLogsInsightsQuerySettings], AwsLogsInsightsQuerySettings]) -> object

  Run a Logs Insights query to the end and return its rows: start it, poll get-query-results until it is Complete, and fail with an AwsLogsQueryError when it ends otherwise or outlasts the timeout.

• static async logs_filter_log_events(ctx: ServiceContext, configure: Callable[[AwsLogsFilterLogEventsSettings], AwsLogsFilterLogEventsSettings] | None=None) -> ExecResult

  Search a log group's events: aws logs filter-log-events.

• static async logs_tail(ctx: ServiceContext, configure: Callable[[AwsLogsTailSettings], AwsLogsTailSettings] | None=None) -> ExecResult

  Print a log group's recent events: aws logs tail.