aws-investigation
Installation
SKILL.md
AWS Investigation
An investigation answers a question about what an AWS account is doing, and every claim in the answer must come from something you read: a deployed artifact, a service's own log record, or a query result. Inference from names, descriptions, the newest stored version or one service's view of another is a lead, never evidence.
Pick the reference
Read the reference that matches the question before you start; most investigations need more than one.
| The question is about | Read |
|---|---|
| What a deployed system currently does, serves or executes: live configuration, feature flags, parameters, which code runs, reproducing a code path's query, or a first data route that is blocked | references/deployed-artifacts.md |
| A request, alarm or incident that spans several services: tracing one request, counting failed requests, deciding where an event was lost | references/multi-service-logs.md |
| Facts in the account's data: finding where data lives, exact counts and breakdowns, filtering, joining or exporting records, the rules behind failed or unmatched records | references/data-investigation.md |
| Whether a finding is complete and a root cause holds: searching every region and scope, paginating before counting, coverage of a date range, one entity vs the whole affected population, consistency of the root cause, whether a runbook fixes the cause, answering the user's own question | references/completeness-and-root-cause.md |