Check the way to AWS

$ grim infra:doctor

Run this before your first infra:aws-* command on a machine, and again whenever one of them stops with Required tools are missing or AWS CLI is not authenticated. Those wizards give up at the first missing piece. grim infra:doctor looks at all the pieces, creates nothing, and tells you how to get each missing one.

It is also the way back in after months away, when you no longer remember which profile belongs to which account.

Usage

$ grim infra:doctor                                        # tools, credentials, default region
$ grim infra:doctor --profile=acme --region=eu-west-1      # another profile, another region
$ grim infra:doctor --guide                                # the full setup guide, even when all is well

Run it from anywhere. It reads your AWS configuration and makes a few read-only calls. It is a different command from grim doctor, which checks a local development machine.

Arguments and options

Diagnose AWS infra prerequisites and walk through credential setup

Usage

grim infra:doctor [--region REGION] [--profile PROFILE] [--guide]

Options

What it actually does

1. Looks for the tools. aws and terraform, each with its version and path, or not installed.
2. Checks the credentials. Asks AWS who you are with the default profile or --profile, and prints the account, its alias, the ARN and the profile. When the alias cannot be read it says so and moves on; the wizards do not need it.
3. Checks the region. Only when step 2 passed: whether regions can be listed, and whether eu-central-1 or --region has a default VPC. grim infra:aws-ec2 places its server there and refuses a region without one.
4. Lists the local AWS profiles and marks the one AWS_PROFILE selects.
5. Prints a verdict. Everything looks good. with the next command to run, or a setup guide for the parts that failed.

The exit code is 0 when both tools are there and the credentials work, and 1 otherwise. A missing default VPC is reported in step 3 and does not change it.

The setup guide

Each failed part brings its own section, and --guide prints them all.

The policy is broad on purpose: all of EC2, S3, IAM, CloudTrail, CloudWatch, SNS and Budgets, plus reading SSM parameters and the caller identity. That is what creating and removing everything in the family takes. The guide says so itself, and tells you to tighten it if your organisation requires least privilege.

Where the family keeps its records

Nothing is stored in a cloud backend. What the wizards know lives in two places under your home directory.

Back these up with the rest of your home directory. On a new machine without them grim cannot remove what it created. The resources are still findable in the AWS console by their tag ManagedBy=grim-cli.

Pitfalls

An SSO session has run out

A profile that worked last week fails the credentials check with AWS's own expiry message. Nothing is broken. Run aws sso login --profile=acme and run the check again.

The check passes and a wizard still fails on permissions

grim infra:doctor proves who you are and that you may list regions. It does not try to create anything, so a policy that is too narrow only shows when Terraform hits the refused call. Compare the user's policy with the one from --guide.

After it finishes

With everything found, the last lines name the next step. On an account with nothing in it yet, a sensible order is the budget first, then the trail, then the server.

$ grim infra:aws-budget --limit=50 --email=ops@example.com
$ grim infra:aws-cloudtrail --preset=minimal
$ grim infra:aws-ec2

grim infra:aws-budget is free and warns you about everything that follows. grim infra:aws-cloudtrail records who did what from then on.

Related spells