AWS CLI

AWS CLI v2 (brew install awscli, 2.35.4 as of 2026-10), at /opt/homebrew/bin/aws. There is no default profile and no access keys on this machine: every profile gets short-lived credentials from a console sign-in through aws login.

Profiles (~/.aws/config)

Profile	What it is	Use it for
qwestly	Me as IAM user dominick in Qwestly's account 557690605076. Group Administrators (full admin, and everything is denied without MFA)	Any Qwestly AWS work: CloudFormation deploys, IAM, S3, Lambda
qwestly-logs	Assumes the read-only role qwestly-log-reader from the qwestly session (source_profile = qwestly)	Searching production logs in CloudWatch, mainly through the workspace skill agent-skills/qwestly-logs

Region is us-east-1 for both. Use them as --profile qwestly or AWS_PROFILE=qwestly.

[profile qwestly]
region = us-east-1
login_session = arn:aws:iam::557690605076:user/dominick

[profile qwestly-logs]
region = us-east-1
role_arn = arn:aws:iam::557690605076:role/qwestly-log-reader
source_profile = qwestly
role_session_name = qwestly-logs-skill

aws login writes the login_session line. qwestly-workspace/agent-skills/qwestly-logs/logs-cli setup writes the rest.

Signing in

aws login --profile qwestly
aws sts get-caller-identity --profile qwestly   # arn:aws:iam::557690605076:user/dominick

This opens the browser and asks which console session to use. Pick the dominick one, signed in with MFA. The CLI refreshes the temporary credentials on its own for up to 12 hours; after that, run aws login again. Agents can't do this step for me, since it needs my password and MFA.

• Console sign-in: https://557690605076.signin.aws.amazon.com/console, user dominick. The credentials are in qwestly-workspace/_private/aws-iam-dominick.txt. That file holds the original temporary password, which I've since changed, so the current password lives in my password manager.
• Gotcha: a 400 Bad Request on us-east-2.signin.aws.amazon.com/oauth means the console session has no MFA. The require-MFA policy then blocks the authorization step. Enroll or use MFA, sign out, sign back in with MFA, and run aws login again. (Hit this on 2026-10-09 before MFA was set up.)
• The root user is only for root-only tasks now. Don't use it for CLI work or deploys.

Common Qwestly commands

# Deploy the log drain stack (from qwestly-workspace/_internal/vercel-log-drain)
AWS_PROFILE=qwestly scripts/deploy.sh

# Search production logs
cd ~/Work/qwestly-workspace && agent-skills/qwestly-logs/logs-cli search --app candidate --since 1h --status 5xx
agent-skills/qwestly-logs/logs-cli whoami

Account notes

• Users: dominick (Administrators, MFA), adam (billing; no MFA as of 2026-10-09), qwestly-app-user (the apps' S3 access key, AmazonS3FullAccess).
• No CloudTrail trail and no AWS Organization or Identity Center as of 2026-10-09. CloudTrail is ticketed in Asana.
• Password policy: 14+ characters, all character classes, can't reuse the last 5.