armoctl-cloud-accounts
Cloud account onboarding — list/connect/disconnect ECS accounts. Use to see which AWS accounts ARMO is monitoring or to onboard a new one.
Install
With your agent
Install OMGSkills skill "armosec/armoctl:skills/armoctl-cloud-accounts" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/armosec/armoctl /tmp/armoctl && ln -s /tmp/armoctl/skills/armoctl-cloud-accounts ~/.claude/skills/armoctl-cloud-accountsFrom README
armoctl-cloud-accounts Cloud accounts is the AWS-side onboarding surface. Today it covers ECS account connection state; future cloud surfaces (EKS, GCP) will land here. Commands ecs — ECS cluster connections ecs connect [cluster-arn] — Get the CloudFormation link for an ECS cluster ecs disconnect [cluster-arn] — Disconnect an ECS cluster from ARMO ecs list — List ECS cluster connections fields — Print the ECS cluster resource cheatsheet Resource fields ecs | Field | Description | |---|---| | clusterARN | AWS ECS cluster ARN. | | name | Cluster name. | | region | AWS region. | | accountID | AWS account ID. | | status | Connection status. | | lastSeen | RFC3339 last-seen time. | Field semantics status — Connection status: connected / pending / failed. 'pending' means CloudFormation rollout is still in progress. Recipes List ECS accounts
More from this repo
armoctl
ARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks,...
armoctl-attack-chains
Attack chains — multi-step kill-chain views built by ARMO from runtime + posture signal.
armoctl-incidents
ARMO runtime incidents — list active threats, fetch alerts on a single incident, explain an incident's signal,...