Super Power

Super Power is a conversational AWS and Kubernetes operations assistant that uses the Amazon Bedrock Converse API. It can inspect resources, investigate metrics and logs, and perform guarded operations after explicit approval.

How to run

python -m pip install super-power-bedrock
super-power

Ask a one-off question:

super-power "List EKS clusters in us-west-2"

Or start an interactive session:

super-power --interactive

Check this machine's AWS identity, Bedrock model access, and Kubernetes client readiness before starting work:

super-power --preflight

Interactive sessions run this credential-safe check at startup. Use --skip-preflight only when you deliberately want to suppress its display; it does not disable runtime safety checks. Within an interactive session, run /doctor to repeat the check.

Choose a model or AWS Region when needed:

super-power --model <model-or-profile-id> --region eu-west-1 "Show EC2 instances"

Requirements

• Python 3.9 or later
• AWS credentials supplied by a standard AWS profile, IAM Identity Center, environment variables, an EC2 instance profile, or an EKS web-identity role
• Amazon Bedrock model access and bedrock:InvokeModel permission for the selected model and Region

Install Kubernetes support when you need Kubernetes API tools:

python -m pip install "super-power[kubernetes]"

Safety

Read-only operations run without confirmation. Operations that create, change, restart, scale, delete, or send commands require approval. A built-in block list refuses destructive commands even when approval is supplied.

The tool does not create AWS credentials, enable Bedrock model access, or change account-level permissions. Never put credentials, access keys, or tokens into source code, memory files, or package configuration.

If Bedrock invocation is denied, preflight identifies the active AWS role, account, model or inference profile, and Region, then explains the smallest safe administrator checks. It never prints credential values. The readiness probe sends a fixed one-token request without conversation history solely to verify the selected model's Converse permission.

Troubleshooting documentation

For AWS and Kubernetes investigations, Super Power can retrieve concise, cited guidance from official AWS and Kubernetes documentation. It only contacts allowlisted HTTPS documentation domains, uses bounded response sizes and timeouts, and never sends credentials or cookies. If documentation is unavailable, it reports the official source link rather than inventing advice.

Interactive terminals use a color-aware Rich interface with a thinking/progress indicator. Set NO_COLOR=1 or redirect output for plain text; --json always emits machine-readable JSON only.

Normal interactive use shows only a generic thinking indicator. Pass --verbose when you need sanitized tool names and activity diagnostics.

EKS workload access

Super Power runs safe diagnostics directly on the host where it is started. It uses SSM only for an explicitly selected different managed instance. To inspect Kubernetes namespaces, pods, events, logs, and deployments, install the Kubernetes extra and allow the agent to create/update local kubeconfig for the chosen EKS cluster. This connects through the Kubernetes API; it does not open an interactive SSH, SSM, or pod-exec session.

License

Apache-2.0. See LICENSE.