List ACM certificates in the account/region, optionally filtered by status.

Describe an ACM certificate in detail.

List API Gateway REST APIs (v1).

List resources (paths) for a REST API, including configured methods.

List deployment stages for a REST API.

List API Gateway v2 APIs (HTTP and WebSocket).

List routes for an HTTP/WebSocket API (v2).

List stages for an HTTP/WebSocket API (v2).

List Athena workgroups.

List databases in an Athena data catalog.

List tables in an Athena database.

Start an Athena SQL query execution. Blocked in --readonly mode. Returns a query execution ID to check results with get_query_results.

Get status and details of an Athena query execution.

Get results of a completed Athena query execution.

List Auto Scaling Groups with their current capacity, health, and instance details.

List scaling policies for Auto Scaling Groups.

Get recent scaling activities for an Auto Scaling Group (scale-out/in events, failures).

List launch configurations used by Auto Scaling Groups.

List AWS Backup plans.

List AWS Backup jobs with their status and resource details.

List AWS Backup vaults.

List recovery points (backups) stored in a backup vault.

List CloudFormation stacks with optional status filter.

Get detailed info for one or all CloudFormation stacks (parameters, outputs, tags).

List all resources in a CloudFormation stack.

Get the CloudFormation template body for a stack.

Get recent events for a CloudFormation stack (useful for debugging deployments).

List CloudFront distributions with domain names, origins, and status.

Get full configuration details for a CloudFront distribution.

List recent cache invalidation requests for a CloudFront distribution.

Create a cache invalidation for a CloudFront distribution. Blocked in --readonly mode.

Describe CloudTrail trails in the account.

Get logging status for a CloudTrail trail.

Look up recent CloudTrail management events. Filter by event name, resource type, user name, etc. Returns the last 90 days by default.

List CloudWatch Log groups with optional prefix filter.

Retrieve log events from a specific CloudWatch log stream. Provide both log_group_name and log_stream_name.

Search CloudWatch log events using a filter pattern across one or more log streams. Useful for searching logs by keyword or pattern.

List CloudWatch alarms with their state and threshold configuration.

List available CloudWatch metrics for a namespace or resource.

Retrieve time-series metric data for one or more CloudWatch metrics. Supports multiple metrics and math expressions in a single call.

Get statistics (Average, Sum, Min, Max) for a single CloudWatch metric over a time period.

List CodeBuild project names.

Get full configuration details for one or more CodeBuild projects.

List recent build IDs for a CodeBuild project.

Get full details (status, logs, duration, phases) for CodeBuild builds.

List CodeDeploy application names.

List deployment groups for a CodeDeploy application.

List CodeDeploy deployments, optionally filtered by application and status.

Get full details of a CodeDeploy deployment (status, duration, error info).

List CodePipeline pipelines.

Get the full structure and stage configuration of a CodePipeline.

Get the current execution state of each stage in a CodePipeline.

List recent executions of a CodePipeline with their status.

List Cognito user pools in the account/region.

Get detailed configuration for a Cognito user pool.

List users in a Cognito user pool with optional filter.

List groups in a Cognito user pool.

Get cost and usage data for a time period. Group by service, account, region, tag, etc. TimePeriod format: {'Start': 'YYYY-MM-DD', 'End': 'YYYY-MM-DD'}.

Get a cost forecast for a future time period.

Describe DocumentDB clusters.

Describe DocumentDB instances.

List DynamoDB tables in the account/region.

Get schema, throughput, indexes, and status for a DynamoDB table.

Query a DynamoDB table using a key condition expression. Items are returned deserialized as plain JSON objects.

Scan a DynamoDB table (reads every item). Use sparingly on large tables. Prefer query when you know the partition key.

Describe EC2 instances. Filter by instance IDs, state, tags, or custom filters. Returns instance details including ID, type, state, IPs, and tags.

Describe EC2 security groups. Filter by group IDs, names, or VPC.

Start, stop, or reboot EC2 instances. In --readonly mode, this executes with DryRun=True to validate permissions without making changes.

List and describe ECR repositories.

List images in an ECR repository with tag status and digest.

Get detailed metadata for ECR images: size, push date, scan status, and vulnerability counts.

Get the lifecycle policy for an ECR repository.

List ECS clusters in the account/region.

Get detailed information about one or more ECS clusters.

List ECS services in a cluster.

Get detailed information about ECS services including deployments and events.

List ECS tasks in a cluster with optional service or status filter.

Get detailed information about ECS tasks.

List EFS file systems with their size, throughput mode, and lifecycle state.

List EFS mount targets for a file system or VPC subnet.

List EFS access points (application-specific entry points with path and permissions).

List EKS clusters in the account/region.

Get detailed EKS cluster info: version, endpoint, VPC config, logging, status, and platform version.

List managed node groups for an EKS cluster.

Get details for an EKS managed node group.

List Fargate profiles for an EKS cluster.

Describe ElastiCache clusters (Redis/Memcached). Returns engine, node type, status, endpoint, and configuration.

Describe ElastiCache Redis replication groups (clusters with replicas). Returns primary/replica endpoints, node groups, and failover settings.

Describe ElastiCache Serverless caches (Redis/Memcached serverless).

Get recent ElastiCache events (maintenance, failover, scaling, etc.).

List ALB, NLB, and Gateway Load Balancers with their DNS names and state.

List target groups, optionally filtered by load balancer.

Get health status of all targets registered in a target group.

List listeners for a load balancer (ports, protocols, rules).

List EMR clusters in the account/region.

Get detailed information about an EMR cluster.

List steps in an EMR cluster.

List EventBridge event buses (default, custom, and partner).

List EventBridge rules, optionally on a specific event bus.

Get full configuration for an EventBridge rule.