Verified AWS contexts for AI agents

Run your AI agent in the right AWS account.

Pick dev, qa, staging, or prod once. awsui authenticates, verifies the AWS identity, and launches your tools in that context.

Get started View on GitHub

STS verified before the child process starts

awsui — verified context locked

$ awsui prod -- codex

Authenticating and verifying AWS identity...

payment-service · PROD PROTECTED

Account 999999999999 ✓

Region ap-northeast-1

Launch codex

● Identity verified. Starting process.

Bring your tool

Claude Code
Codex
Kiro
Terraform
Antigravity
Any CLI

One choice, every process

Think in environments, not local profile names.

Your team shares the intended account and region. Each developer keeps their own local AWS profile binding.

Define

Commit project contexts

Describe dev, qa, staging, and prod once in a project-level .awsui.yaml.

prod → 999999999999

Bind

Map your local profile

Keep machine-specific profile names outside Git while sharing the same logical environments.

$ awsui bind prod

Verify & launch

Start any tool safely

awsui verifies the authenticated account, sets the region, and only then starts the child process.

$ awsui prod -- codex

Designed to fail closed

The context is verified, not assumed.

A familiar profile name is not proof. awsui checks the real AWS identity before handing control to your agent or CLI.

STS identity check

Verified before launch

Expected and authenticated account IDs must match. Wrong but valid credentials are blocked before they reach your command.

Expected account 999999999999

Authenticated 999999999999 ✓

Production safety

Fail closed

A mismatch or failed identity check means the command never starts.

✕ Command was not started.

Team-friendly

Shared intent, local bindings

Commit account and region definitions without committing each developer's profile names.

Deterministic runtime

A clean child environment

Profile and region are set while direct credential overrides are removed from the launch environment.

Tool-agnostic

Bring your AI

Claude Code, Codex, Kiro, Terraform, scripts, or an interactive shell—all use the same verified context.

Built for guarded workflows

One verified AWS context for every AI coding agent.

Use the same project intent across Codex, Claude Code, Terraform, Antigravity, and any CLI without sharing developer-specific profile names.

AI coding agents

Launch Codex and Claude Code in the intended account

Choose dev, staging, or prod. awsui resolves the developer's local profile, authenticates it, checks the STS account, and only then starts the agent.

Infrastructure tooling

Put Terraform and deployment CLIs behind an identity check

Commands never start when the authenticated AWS account does not match the account declared for the project environment.

Team environments

Share account intent without sharing local profile names

Commit expected accounts and regions in .awsui.yaml while each developer keeps their machine-specific profile binding local.

CLI walkthrough

From project setup to a verified tool launch.

Define the project once, keep profile bindings local, and verify the real AWS identity before any child process starts.

Terminal demonstration of awsui init creating shared project contexts — 01 · Initialize Create the shared project contexts.

02 · Bind Map the environment to a local AWS profile.

Terminal demonstration of awsui verifying the authenticated AWS account — 03 · Verify Confirm the authenticated account matches.

Terminal demonstration of awsui launching Codex after AWS identity verification — 04 · Launch Start Codex inside the verified context.

Quick start

From install to verified context in minutes.

awsui uses the credentials already managed by AWS CLI. It never stores AWS credentials itself.

Terminal

Install and run

# Install as an isolated tool
uv tool install --python 3.13 awsui

# Initialize this AWS project
cd payment-service
awsui init
awsui bind prod

# Verify, then launch
awsui context prod
awsui prod -- codex
awsui dev

# Compatible explicit forms
awsui run prod -- claude
awsui shell dev

.awsui.yaml

Shared project intent

version: 1
project: payment-service
contexts:
  dev:
    account: "111111111111"
    region: ap-northeast-1
  prod:
    account: "999999999999"
    region: ap-northeast-1
    protected: true

Python3.13

AWS CLIv2 required

CredentialsManaged by AWS CLI

LicenseMIT

Frequently asked

Questions about verified AWS contexts.

Short answers for teams bringing AI agents and CLI tools into AWS.

What does awsui mean by an AWS context?

A named project environment such as dev or prod. It declares the expected 12-digit AWS account and region, then maps that shared intent to a local AWS profile.

How does awsui verify the AWS account before launch?

It authenticates the bound profile, queries AWS STS caller identity, compares the returned account with the project configuration, and aborts when identity is unavailable or mismatched.

Does awsui store AWS credentials?

No. awsui uses the credentials and SSO sessions already managed by AWS CLI, prepares a deterministic child environment, and does not persist AWS access keys or session tokens.

Which AI agents and CLI tools can awsui launch?

Any child process can run inside a verified context, including Codex, Claude Code, Kiro, Antigravity, Terraform, and AWS CLI. awsui supports macOS, Linux, and Windows wherever Python 3.13 and AWS CLI v2 are available.

Documentation

awsui brings the AWS context.

Install awsui