#aws#sagemaker#cloud#credentials#context

AWS Context Discovery

Independent PiSkill directory guide. The original skill remains hosted by Hugging Face Skills.

What is AWS Context Discovery?

Discovers the active AWS profile, region, account, and caller identity before Hugging Face cloud or SageMaker work so later steps use the correct AWS context.

What does AWS Context Discovery do?

AWS Context Discovery is a Hugging Face skill that should run before AWS deployment work to determine the active AWS profile, region, account ID and caller identity from the user's actual local configuration. Its main purpose is to stop agents from guessing credentials or regions and to surface permission constraints early.

Who is AWS Context Discovery best for?

  • Developers deploying Hugging Face workloads to AWS
  • Users with several AWS profiles or regions
  • Teams using SSO or assumed roles
  • Agents preparing SageMaker or other AWS API calls

Common use cases

  • Resolve the effective AWS profile and region
  • Validate credentials with STS
  • Determine the current AWS account ID and caller ARN
  • Detect SSO identities that may not be able to create IAM roles

How does AWS Context Discovery work?

The skill reads the explicit conversation context and local AWS configuration in priority order, then validates the resolved identity with `aws sts get-caller-identity`. It interprets the caller ARN so permission limitations such as SSO-based IAM restrictions can be surfaced before a later deployment fails.

Key benefits

  • Prevents hard-coded region guesses
  • Catches expired or invalid credentials early
  • Makes AWS account and caller identity explicit
  • Surfaces likely SSO permission limitations before deployment

Things to know

  • The workflow requires access to the user's local AWS configuration and CLI
  • It discovers context but does not grant missing permissions
  • Organization-specific IAM policy can still differ from typical SSO behavior

Compatible tools

Claude CodeOpenAI CodexGemini CLICursor

Frequently asked questions

Why use AWS Context Discovery before deploying?
It resolves the real profile, region, account and caller identity first so later AWS commands do not run against the wrong account or rely on guessed defaults.
Why does the skill inspect the caller ARN?
The ARN reveals whether the user is an IAM user, regular assumed role or SSO role, which can affect whether later IAM operations are likely to succeed.
← Back to Skills Directory