@libai168/dsh-tool-aws

Configuration

- name: 'github:LJH-snow/dsh-tool-aws'
  config:
    region: 'us-east-1'
    accessKeyId: 'AKIA...'
    secretAccessKey: '...'
    # sessionToken: '...'   # temporary credentials
    # endpoint: '...'       # optional public HTTP(S) root endpoint
    # timeoutMs: 15000

The optional endpoint must be an absolute http:// or https:// root URL (for example, https://aws-api.example.test/). Only publicly reachable hosts are allowed. Localhost, loopback, private, link-local, carrier-grade NAT, multicast, and every IANA special-purpose block — reserved/documentation/benchmark ranges, the 2001::/23 IETF protocol assignments prefix, deprecated site-local, SRv6 SIDs, AS112, and IPv4-mapped/NAT64 forms — are rejected, together with hostnames resolving to any such address. Credentials, query strings, fragments, and non-root paths are not allowed. DNS failures are rejected before any request is sent.

Use an IAM user or role with read-only permissions (ec2:DescribeInstances, s3:ListAllMyBuckets, lambda:ListFunctions, logs:DescribeLogGroups, logs:FilterLogEvents, cloudwatch:ListMetrics, sts:GetCallerIdentity).