Skip to content

Managing AWS with GitHub Copilot

At a glance
Status Complete
Stack GitHub Copilot (agent mode in VS Code), AWS CLI v2, IAM, Route 53, ACM, CloudFront, GitHub Pages
Time About an hour, from no CLI to a documented account plus two new subdomains

Overview

My AWS account had built up resources over a few years: old EC2 instances, leftover training-lab stacks, duplicate DNS zones. I had no clear picture of what was running or what it cost. I used GitHub Copilot as an agent: it ran the AWS CLI on my behalf, wrote down what it found, and made changes only after I approved them.

How it works

flowchart LR
    A[Me] -- plain-English requests --> B[Copilot agent]
    B -- AWS CLI commands --> C[(AWS account)]
    C -- results --> B
    B -- proposes changes --> A
    A -- approves --> B
    B -- writes --> D[Markdown docs]
  1. Setup. Copilot installed the AWS CLI and walked me through creating a dedicated IAM user for it. I didn't use root access keys, and I typed the keys straight into aws configure, never into the chat.
  2. Read-only first. The IAM user started with only ReadOnlyAccess and AWSBillingReadOnlyAccess. That was enough for Copilot to check every region, pull six months of Cost Explorer data, and go through IAM, VPCs, security groups, S3, Route 53, CloudTrail and billing alarms.
  3. Documentation. Copilot turned the results into two Markdown files: one covering how access was set up, and a full description of the account with a prioritised list of findings.
  4. Changes with approval. When I wanted to make changes, I added PowerUserAccess. Copilot set out each step and waited for my approval before running it.

What it built

aws.<my-domain> → AWS console sign-in

A DNS record can't point at a full URL, so Copilot set up a small redirect service:

  • ACM certificate, validated through DNS in Route 53
  • CloudFront Function that returns a 301 to my account's sign-in URL
  • CloudFront distribution that uses the certificate and runs the function on every request
  • Route 53 alias records pointing the subdomain at CloudFront

It cost $0, since the traffic stays inside the free tier. Copilot checked it with curl before calling it done.

lab-notes.<my-domain> → this site

Copilot checked my repo, saw that GitHub Pages deploys through GitHub Actions (so no CNAME file is needed), and added a Route 53 CNAME to jakeumm.github.io. I set the custom domain in the repo's Pages settings.

What the audit found (high level)

  • Cost: about $8/month, almost all of it disk storage for stopped EC2 instances.
  • Leftovers: resources from an old training lab, an unused DNS hosted zone, empty buckets, failed SSL certificates.
  • Security: a list of hardening items covering MFA, old access keys, overly open security groups, and security services that weren't turned on.

What I learned

  • Least privilege works with AI agents. Starting read-only meant there was no risk while Copilot explored, and I added write access only once I knew what it needed.
  • Asking before each change kept me in control. Each change was small and explained, and I approved it before it ran.
  • The documentation came for free. The best output wasn't any single command. It was an accurate written description of an account I'd lost track of.
  • Agents still make mistakes. One CLI call broke on PowerShell quoting. Copilot noticed, confirmed nothing had been created, and retried a different way. Checking the actual result matters.

Roadmap

  • Set up the CLI and a least-privilege IAM user
  • Read-only inventory, cost review, and account documentation
  • Console shortcut subdomain (CloudFront + ACM)
  • lab-notes subdomain for GitHub Pages
  • Work through the security hardening list
  • Clean up unused resources and old lab stacks
  • Manage the account's DNS and redirects as infrastructure as code