@kody/aws

@kody/aws

Official AWS smile wordmark (paths from Amazon Web Services) in Squid Ink #252F3E and Amazon Orange #FF9900. Amazon Web Services® and the AWS logo are trademarks of Amazon.com, Inc. or its affiliates. This package is not affiliated with or endorsed by Amazon.

Intent

Give agents a fork-ready AWS toolkit for STS identity, S3 list/metadata, CloudWatch logs and metrics, and generic SigV4-signed REST. Auth is a saved access key plus secret key (optional session token). Reads stay slim. S3 never dumps object bodies. Writes support dryRun and require confirm: true.

This listing is meant to be forked. The live @kody/aws package does not talk to a shared AWS account. After you fork, save your own credentials and call the helpers in your account. No account ids or bucket names belong in this package.

Share this package as https://kody.codes/@kody/aws

Agent setup

1. Create an IAM user or role session with least-privilege keys from the IAM console. Never paste secret values into chat.
2. Save the access key id:

https://kody.codes/account/secrets/new?name=awsAccessKeyId&description=AWS%20access%20key%20id%20(AKIA...)&allowedHosts=sts.amazonaws.com,sts.us-east-1.amazonaws.com,s3.amazonaws.com,s3.us-east-1.amazonaws.com,logs.us-east-1.amazonaws.com,monitoring.us-east-1.amazonaws.com&scope=user

3. Save the secret access key:

https://kody.codes/account/secrets/new?name=awsSecretAccessKey&description=AWS%20secret%20access%20key&allowedHosts=sts.amazonaws.com,sts.us-east-1.amazonaws.com,s3.amazonaws.com,s3.us-east-1.amazonaws.com,logs.us-east-1.amazonaws.com,monitoring.us-east-1.amazonaws.com&scope=user

4. Optional temporary session token:

https://kody.codes/account/secrets/new?name=awsSessionToken&description=Optional%20AWS%20session%20token%20for%20temporary%20credentials&allowedHosts=sts.amazonaws.com,sts.us-east-1.amazonaws.com,s3.amazonaws.com,s3.us-east-1.amazonaws.com,logs.us-east-1.amazonaws.com,monitoring.us-east-1.amazonaws.com&scope=user

5. Approve those amazonaws.com hosts. Add {service}.{region}.amazonaws.com when you call another region.
6. Run the smoke test below.

Default region is us-east-1 unless you pass region or store a fork-local default with ./config.

Additional accounts

Pass account: "work" to use awsAccessKeyId-work / awsSecretAccessKey-work.

Exports

• kody:@kody/aws — package overview and safety metadata
• kody:@kody/aws/guide — console steps and prefilled secret URLs
• kody:@kody/aws/smoke-test — dry-run self-check; live STS only when secrets mount
• kody:@kody/aws/identity — STS GetCallerIdentity (account / ARN / user id)
• kody:@kody/aws/s3 — list buckets, list objects, HEAD metadata; put/delete dry-run
• kody:@kody/aws/logs — CloudWatch log groups and redacted log events
• kody:@kody/aws/metrics — CloudWatch metric list and statistics
• kody:@kody/aws/request — generic signed REST escape hatch
• kody:@kody/aws/config — optional default region in packageStorage()

The optional identity-check job is disabled by default.

Smoke test

import smokeTest from 'kody:@kody/aws/smoke-test'

export default async function main() {
	return await smokeTest()
}

Without credentials this returns { ok: true, live: false } plus the setup URLs. It never prints secret values or S3 object bodies.

dryRun

S3 put/delete and other writes default to dry-run. They return a preview unless confirm: true (and dryRun is not true).

import { putObject } from 'kody:@kody/aws/s3'

export default async function main() {
	return putObject({
		bucket: 'example-bucket',
		key: 'notes.txt',
		body: 'hello',
	})
}

That call previews. A live write after explicit user approval of the exact bucket and key:

import { putObject } from 'kody:@kody/aws/s3'

export default async function main() {
	return putObject({
		bucket: 'example-bucket',
		key: 'notes.txt',
		body: 'hello',
		confirm: true,
	})
}

Notes

• S3 getObjectMetadata is HEAD-only. This package will not dump object bodies.
• Log and generic REST helpers redact credential-shaped text.
• Live @kody/aws packageStorage() is the platform bucket — fork first.
• This package is not affiliated with or endorsed by Amazon.

Docs

• IAM access keys
• STS GetCallerIdentity
• S3 API
• CloudWatch Logs
• CloudWatch Metrics