aws_call
Call any AWS read operation from Describe/Get/List/Filter/Lookup families via boto3, with automatic pagination and read-only enforcement. Mutations need explicit opt-in and a confirmation token.
Instructions
Generic boto3 passthrough for the AWS read surface: call any Describe*/Get*/List*/Filter*/Lookup* operation that isn't pre-wrapped (DescribeSecurityGroupRules, GetIPSet, GetWebACL, FilterLogEvents, DescribeTargetHealth, …). operation is the boto3 snake_case method name; params is the boto3 argument object (PascalCase keys). Reads auto-paginate and run read-only. Mutating ops need mutate=true AND dangerous guard mode. Destructive verbs (delete/terminate/destroy/purge) are refused unless enabled in config, and even then require a two-phase confirm (first call returns a token + summary and does NOT touch AWS; re-call with confirm= to execute). region/account pin the call.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mutate | No | Required true to run any non-read operation (including destructive ones). | |
| params | No | boto3 argument object (PascalCase keys), e.g. {"GroupIds": ["sg-0abc"]}. | |
| region | No | AWS region. Empty uses the configured default region. | |
| account | No | Account id selecting a per-account control-plane role (optional). | |
| confirm | No | Second-phase confirmation token for a destructive op. Leave empty on the first call to receive a summary + token; re-call with the token to execute. | |
| service | Yes | AWS service id, e.g. 'ec2', 'wafv2', 'elbv2', 'logs', 'rds'. | |
| max_items | No | Cap on auto-paginated read items (0 = default 1000). | |
| operation | Yes | boto3 snake_case operation, e.g. 'describe_security_group_rules', 'get_ip_set', 'filter_log_events'. |