Cloud Instance Ops

English | 简体中文

Operate cloud instances safely through SSH and official cloud CLIs, with clear guardrails for access constraints, deployment checks, and blocked-state handoffs.

cloud-instance-ops is a reusable skill package for Codex, OpenClaw, and Claude Code. It helps agents handle routine cloud instance work without pretending that MFA, SSO, allowlists, bastions, or missing permissions do not exist.

Why this project is useful

• SSH and CLI first: optimized for Linux instance work, AWS EC2, and Aliyun ECS.
• Safe by default: prefers read-only checks before mutating actions.
• Clear blocked-state behavior: returns ok, blocked, denied, needs_user, or unsupported instead of vague failure text.
• Deployment-aware: includes model deployment checks such as preflight, artifact validation, repeated request verification, and output sanity checks.
• Portable across agents: keeps the core operating logic in shared markdown and Python scripts.

What is inside

• SKILL.md: the main operating contract and workflow
• agents/openai.yaml: Codex-facing metadata
• references/: focused guidance for AWS, Aliyun, Linux, restricted access, shared runtime hygiene, and deployment work
• scripts/: helper tools for preflight checks, SSH probing, password SSH reuse, artifact checks, and result normalization

Typical use cases

• Connect to a Linux instance through SSH, password SSH, ProxyJump, or a bastion
• Inspect logs, services, ports, and process state before making changes
• Run safe cloud-level instance checks with AWS CLI or Aliyun CLI
• Diagnose blocked access paths such as SSO, MFA, approval gates, VPN, or IP allowlists
• Deploy a model or API with evidence-based acceptance checks instead of "port is listening, so it must be fine"

Quick start

1. Copy or symlink the skill

Keep the whole directory together:

cloud-instance-ops/
├── SKILL.md
├── agents/openai.yaml
├── references/
└── scripts/

2. Run a local preflight

python3 scripts/preflight.py \
  --cloud generic \
  --action inspect \
  --host 10.0.0.8 \
  --check-port

3. Probe SSH before doing anything risky

python3 scripts/ssh_probe.py \
  --host 10.0.0.8 \
  --user ubuntu \
  --identity-file ~/.ssh/prod.pem

4. Normalize failures into a stable handoff

python3 scripts/normalize_result.py \
  --exit-code 255 \
  --stderr 'Permission denied (publickey)' \
  --command 'ssh -i ~/.ssh/prod.pem ubuntu@10.0.0.8'

Example output

{
  "status": "blocked",
  "reason": "The current environment cannot complete the command with the available network or credentials.",
  "next_step": "Fix the access path, refresh credentials, or use the approved bastion/VPN flow, then retry.",
  "evidence": {
    "command": "ssh -i ~/.ssh/prod.pem ubuntu@10.0.0.8",
    "exit_code": 255,
    "stdout": "",
    "stderr": "Permission denied (publickey)"
  }
}

Design principles

• Do not bypass MFA, SSO, captchas, approval workflows, or least-privilege controls.
• Do not claim a deployment succeeded just because a service started.
• Do not mutate shared runtimes until target identity, port ownership, and dependency constraints are understood.
• Do return the smallest useful next step when work is blocked.

Repository structure

cloud-instance-ops/
├── README.md
├── LICENSE
├── SKILL.md
├── agents/
├── docs/
├── references/
└── scripts/

Compatibility

• Codex
• OpenClaw
• Claude Code
• Generic SSH and cloud CLI workflows

Homepage

The repository includes a lightweight project homepage draft at docs/index.html. It is written for a GitHub Pages style presentation with a clear, value-first introduction.

License

MIT