AWS Account Switching

Three shells, three risk tiers. aws-dev is low risk and opens instantly. aws-uat is medium. aws-prod is high risk with requires_approval: true and prints a loud warning banner before handing you a prompt — the same shell definition an agent would be blocked from opening without human confirmation. Each shell’s init_cmds doesn’t just check the SSO session — if it’s missing or expired, it actually triggers aws sso login for you, then verifies again before handing you a confirmed-authenticated prompt.

version: v1

shells:
  aws-dev:
    description: "AWS shell for the development account"
    agent:
      risk_level: low
    env:
      AWS_PROFILE:
        type: string
        default: "dev"
      AWS_REGION:
        type: string
        default: "us-east-1"
    init_cmds:
      - aws sts get-caller-identity >/dev/null 2>&1 || aws sso login --profile $AWS_PROFILE
      - aws sts get-caller-identity >/dev/null 2>&1 || (echo "Login failed for profile $AWS_PROFILE — check your SSO configuration" && exit 1)
      - echo "Logged into AWS Development — account $(aws sts get-caller-identity --query Account --output text)"

  aws-uat:
    description: "AWS shell for the UAT/staging account"
    agent:
      risk_level: medium
    env:
      AWS_PROFILE:
        type: string
        default: "uat"
      AWS_REGION:
        type: string
        default: "us-east-1"
    init_cmds:
      - aws sts get-caller-identity >/dev/null 2>&1 || aws sso login --profile $AWS_PROFILE
      - aws sts get-caller-identity >/dev/null 2>&1 || (echo "Login failed for profile $AWS_PROFILE — check your SSO configuration" && exit 1)
      - echo "Logged into AWS UAT — account $(aws sts get-caller-identity --query Account --output text)"
      - echo "This is the UAT/staging environment. Changes may affect QA testing."

  aws-prod:
    description: "AWS shell for the production account"
    agent:
      risk_level: high
      requires_approval: true
      confirmation: "You are about to access the PRODUCTION AWS account. Continue?"
    env:
      AWS_PROFILE:
        type: string
        default: "prod"
      AWS_REGION:
        type: string
        default: "us-east-1"
    init_cmds:
      - aws sts get-caller-identity >/dev/null 2>&1 || aws sso login --profile $AWS_PROFILE
      - aws sts get-caller-identity >/dev/null 2>&1 || (echo "Login failed for profile $AWS_PROFILE — check your SSO configuration" && exit 1)
      - echo "=============================================="
      - echo "  PRODUCTION ACCOUNT — all changes affect real users"
      - echo "=============================================="

Run it:

meriadoc shell aws-dev