hf-cloud-aws-context-discovery

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

AWS Context Discovery

AWS上下文发现

Before doing any AWS work, read the user's local AWS config. Don't guess the region, and don't ask the user for things their config already answers.

在执行任何AWS操作前，请读取用户本地的AWS配置。不要猜测区域，也不要询问用户配置中已包含的信息。

What to discover

需要获取的信息

Run these at the start of the AWS work and remember the results for the rest of the session.

在AWS操作开始时执行以下步骤，并在整个会话中保留结果。

1. Active profile

1. 活跃配置文件

AWS_PROFILE

env var, else

default

. If the user mentioned a profile in their prompt, that overrides. If the named profile doesn't exist in

~/.aws/config

, surface that clearly.

优先读取

AWS_PROFILE

环境变量，若不存在则使用

default

。如果用户在提示中提到了特定配置文件，则以用户指定的为准。如果指定的配置文件在

~/.aws/config

中不存在，请明确告知用户。

2. Region

2. 区域

Resolution order — stop at the first one that produces a value:

Region the user explicitly named in this conversation
```
AWS_REGION
```
env var
```
AWS_DEFAULT_REGION
```
env var
```
region
```
field on the active profile in
```
~/.aws/config
```
Ask the user — but only after the first four have failed

Do not fall back to

us-east-1

or any other hardcoded default.

按以下优先级顺序解析，找到第一个有效值后停止：

用户在本次对话中明确指定的区域
```
AWS_REGION
```
环境变量
```
AWS_DEFAULT_REGION
```
环境变量
活跃配置文件在
```
~/.aws/config
```
中的
```
region
```
字段
询问用户——仅当前四个方式都失败时才执行

请勿默认回退到

us-east-1

或任何其他硬编码的默认区域。

3. Credentials, account ID, caller ARN

3. 凭证、账户ID、调用者ARN

bash

aws sts get-caller-identity --profile <profile> --region <region>

Three purposes in one call: confirms credentials are valid (stop if not), returns the

Account

ID (needed for ARN construction), returns the

Arn

of the caller.

bash

aws sts get-caller-identity --profile <profile> --region <region>

该命令可同时实现三个目的：验证凭证是否有效（若无效则停止操作）、返回

Account

ID（用于构造ARN）、返回调用者的

Arn

。

4. Identify SSO / assumed-role principals

4. 识别SSO / 角色扮演主体

The

Arn

field tells you what kind of principal this is. The pattern matters because it determines what IAM operations the caller can do.

ARN pattern	Type	IAM write capability
`arn:aws:iam::<acct>:user/<name>`	IAM user	Depends on attached policies
`arn:aws:sts::<acct>:assumed-role/AWSReservedSSO_<...>/<email>`	SSO assumed-role	Typically none — can't create/modify IAM roles
`arn:aws:sts::<acct>:assumed-role/<role>/<session>`	Regular assumed-role	Depends on the role

If the caller is SSO, surface this immediately before later skills hit

iam:CreateRole

and fail:

Heads up: you're authenticated via SSO (
AWSReservedSSO_<PermissionSet>_...
). SSO principals usually can't create IAM roles directly. If we need a SageMaker execution role, I'll look for an existing one first — if none exists, you'll need to ask whoever manages your AWS access to create one.

This is the highest-leverage thing this skill does. Surfacing it now turns a confusing mid-deployment error into a five-second conversation.

Arn

字段可告知你当前主体的类型。ARN的格式非常重要，因为它决定了调用者可执行的IAM操作。

ARN格式	类型	IAM写入权限
`arn:aws:iam::<acct>:user/<name>`	IAM用户	取决于附加的策略
`arn:aws:sts::<acct>:assumed-role/AWSReservedSSO_<...>/<email>`	SSO角色扮演	通常无——无法创建/修改IAM角色
`arn:aws:sts::<acct>:assumed-role/<role>/<session>`	常规角色扮演	取决于角色权限

若调用者通过SSO认证，请在后续技能执行

iam:CreateRole

操作失败前立即告知用户：

注意：你当前通过SSO（
AWSReservedSSO_<PermissionSet>_...
）进行认证。SSO主体通常无法直接创建IAM角色。如果我们需要SageMaker执行角色，我会先查找现有角色——若不存在，你需要联系AWS权限管理员创建该角色。

这是该技能最关键的作用。提前告知用户可将部署过程中令人困惑的错误转化为简短的沟通。

Commands to run

需执行的命令

bash

undefined

bash

undefined

Effective profile and region (faster than parsing config files)

获取有效配置文件和区域（比解析配置文件更快）

aws configure list

Validate credentials and get identity

验证凭证并获取身份信息

aws sts get-caller-identity aws sts get-caller-identity --profile <profile-name> # if a profile was named


`aws configure list` handles env-var overrides and shows the resolved effective values. Prefer it over parsing `~/.aws/config` yourself. If you need to read raw config (e.g. to list profiles), `~/.aws/config` and `~/.aws/credentials` are plain INI files — read-only.

aws sts get-caller-identity aws sts get-caller-identity --profile <profile-name> # 如果指定了配置文件


`aws configure list`会处理环境变量覆盖，并显示解析后的有效值。优先使用该命令，而非自行解析`~/.aws/config`。如果需要读取原始配置（例如列出所有配置文件），`~/.aws/config`和`~/.aws/credentials`是纯INI文件——仅读取即可。

What to report back

需反馈的内容

One or two lines, not a wall of text:

Working with profile
my-profile
in
eu-west-1
, account
123456789012
. You're authenticated via SSO, so we'll need to use an existing IAM role rather than create one.

Don't ask the user to confirm the region you just read from their config — they configured it; that is the confirmation.

If something is wrong (credentials expired, profile doesn't exist, no region anywhere), stop and surface the specific error before continuing.

用1-2行简洁表述，不要大段文字：

当前使用配置文件
my-profile
，区域为
eu-west-1
，账户ID为
123456789012
。你通过SSO认证，因此我们将使用现有IAM角色而非创建新角色。

无需让用户确认你刚从配置中读取的区域——用户已配置过，这就是确认。

如果出现错误（凭证过期、配置文件不存在、未找到任何区域信息），请立即停止操作并明确告知具体错误，再继续后续步骤。