Setting the chapter. One moment.
Skills
Chapter 3 of 26
Discover the user’s local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task.
2 minutes · 416 words · 8 sections
Before doing any AWS work, read the user’s local AWS config. Don’t guess the region, and don’t ask the user for things their config already answers.
Run these at the start of the AWS work and remember the results for the rest of the session.
AWS_PROFILE env var, else default. If the user mentioned a profile in their prompt, that overrides. If the named profile doesn’t exist in ~/.aws/config, surface that clearly.
Resolution order — stop at the first one that produces a value:
AWS_REGION env varAWS_DEFAULT_REGION env varregion field on the active profile in ~/.aws/configDo not fall back to us-east-1 or any other hardcoded default.
aws sts get-caller-identity --profile <profile> --region <region>Three purposes in one call: confirms credentials are valid (stop if not), returns the Account ID (needed for ARN construction), returns the Arn of the caller.
The Arn field tells you what kind of principal this is. The pattern matters because it determines what IAM operations the caller can do.
| ARN pattern | Type | IAM write capability |
|---|---|---|
arn:aws:iam::<acct>:user/<name> | IAM user | Depends on attached policies |
arn:aws:sts::<acct>:assumed-role/AWSReservedSSO_<...>/<email> | SSO assumed-role | Typically none — can’t create/modify IAM roles |
arn:aws:sts::<acct>:assumed-role/<role>/<session> | Regular assumed-role | Depends on the role |
If the caller is SSO, surface this immediately before later skills hit iam:CreateRole and fail:
Heads up: you’re authenticated via SSO (
AWSReservedSSO_<PermissionSet>_...). SSO principals usually can’t create IAM roles directly. If we need a SageMaker execution role, I’ll look for an existing one first — if none exists, you’ll need to ask whoever manages your AWS access to create one.
This is the highest-leverage thing this skill does. Surfacing it now turns a confusing mid-deployment error into a five-second conversation.
# Effective profile and region (faster than parsing config files)
aws configure list
# Validate credentials and get identity
aws sts get-caller-identity
aws sts get-caller-identity --profile <profile-name> # if a profile was namedaws configure list handles env-var overrides and shows the resolved effective values. Prefer it over parsing ~/.aws/config yourself. If you need to read raw config (e.g. to list profiles), ~/.aws/config and ~/.aws/credentials are plain INI files — read-only.
One or two lines, not a wall of text:
Working with profile
my-profileineu-west-1, account123456789012. You’re authenticated via SSO, so we’ll need to use an existing IAM role rather than create one.
Don’t ask the user to confirm the region you just read from their config — they configured it; that is the confirmation.
If something is wrong (credentials expired, profile doesn’t exist, no region anywhere), stop and surface the specific error before continuing.
Install this repository
npx skills add huggingface/skills/plugin marketplace add huggingface/skillsSkills install per repository, not per chapter — the CLI has no documented per-skill form, so we do not print one.
Discover the user's local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task. Use this skill before any other AWS work — deploying to SageMaker, creating resources, calling AWS APIs, or anything that touches an AWS account. Use it especially when the user has not specified a region or profile explicitly, when they say things like "use my AWS account", "deploy to AWS", "use my profile", or when about to make any AWS CLI or SDK call. Never guess the region or account ID — always use this skill to read it from the local configuration first.
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
main, last pushed 7 August 2026.SKILL.md, not by matching a directory convention. 2 distinct layouts observed: hf-mcp/skills/*/SKILL.md, skills/*/SKILL.md.h1 and no skipped levels:.claude-plugin/marketplace.json by Hugging Face, declaring 1 plugin. It is read for editorial metadata only — never as the skill index, which is always the repository tree./huggingface/skills.md, and each chapter at its own .md URL.