Aws/service Quotas
Query and monitor AWS Service Quotas across accounts. Fan-out utilization checks identify quotas approaching their limits before they cause failures.
Authentication
Uses the default AWS credential chain via named profiles.
Required IAM Permissions
servicequotas:GetServiceQuotaservicequotas:ListServiceQuotasservicequotas:ListServicesservicequotas:ListRequestedServiceQuotaChangeHistory(for list_pending_requests)servicequotas:GetAWSDefaultServiceQuotacloudwatch:GetMetricData(for usage metrics)sts:GetCallerIdentity
Usage
# Create model
swamp model create @webframp/aws/service-quotas quotas \
--set profiles='["prod-readonly","staging-readonly"]'
# Check IAM role quota
swamp model method run quotas get_quota \
--input serviceCode=iam --input quotaCode=L-FE177D64
# List all IAM quotas
swamp model method run quotas list_quotas --input serviceCode=iam
# Find quotas above 80% utilization across accounts
swamp model method run quotas check_utilization \
--input serviceCode=iam --input threshold=0.8
# Sweep several services in one fan-out (one utilization snapshot each)
swamp model method run quotas check_utilization \
--input serviceCodes='["ec2","vpc","eks"]' --input threshold=0.8
# List open quota-increase requests (PENDING/CASE_OPENED) across accounts
swamp model method run quotas list_pending_requests2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (5 packages)
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
| Argument | Type | Description |
|---|---|---|
| serviceCode | string | AWS service code (e.g. 'iam') |
| quotaCode | string | Quota code (e.g. 'L-FE177D64') |
| Argument | Type | Description |
|---|---|---|
| serviceCode | string | AWS service code (e.g. 'iam') |
| Argument | Type | Description |
|---|---|---|
| serviceCode | string | AWS service code (e.g. 'iam') |
| quotaCode | string | Quota code (e.g. 'L-FE177D64') |
| desiredValue | number | Requested new quota value |
Resources
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.07.21.1
Changed: Bumped AWS SDK dependencies to 3.1091.0 (from 3.1090.0).
Upgrade note: No behavioral changes. Routine dependency maintenance.
2026.07.18.2
Added: An upgrades array entry (no-op) to service-quotas.ts for proper typeVersion tracking on existing instances. No schema or behavior changes.
2026.07.18.1
Changed: Bumped @aws-sdk/client-cloudwatch,
@aws-sdk/client-service-quotas, @aws-sdk/client-sts,
@aws-sdk/client-support, and @aws-sdk/credential-providers from
3.1069.0 to 3.1090.0 for dependency freshness. No behavior change.
2026.07.10.1
Changed: Hardened failedProfiles error redaction. Persisted error text now
also strips internal URLs and ANSI color codes, and collapses the common
granted/AWS SSO credential-process failure to a short, actionable code
(sso-login-required). Previously the raw error embedded the organization's SSO
portal URL, which would surface in the briefing-facing snapshot. Real
identifiers (ARNs, account ids) are still redacted as before. No API, schema, or
method-signature changes.
2026.07.18.1
Changed: Bumped @aws-sdk/client-cloudwatch,
@aws-sdk/client-service-quotas, @aws-sdk/client-sts,
@aws-sdk/client-support, and @aws-sdk/credential-providers from
3.1069.0 to 3.1090.0 for dependency freshness. No behavior change.
2026.07.10.1
Changed: Hardened failedProfiles error redaction. Persisted error text now
also strips internal URLs and ANSI color codes, and collapses the common
granted/AWS SSO credential-process failure to a short, actionable code
(sso-login-required). Previously the raw error embedded the organization's SSO
portal URL, which would surface in the briefing-facing snapshot. Real
identifiers (ARNs, account ids) are still redacted as before. No API, schema, or
method-signature changes.
2026.07.10.1
Changed: Hardened failedProfiles error redaction. Persisted error text now
also strips internal URLs and ANSI color codes, and collapses the common
granted/AWS SSO credential-process failure to a short, actionable code
(sso-login-required). Previously the raw error embedded the organization's SSO
portal URL, which would surface in the briefing-facing snapshot. Real
identifiers (ARNs, account ids) are still redacted as before. No API, schema, or
method-signature changes.
2026.07.09.1
Added: list_pending_requests method — read-only fan-out across all
configured profiles listing quota-increase requests still open (PENDING or
CASE_OPENED) via the ListRequestedServiceQuotaChangeHistory API. Produces one
pendingRequests resource aggregating every open request across accounts.
Changed: check_utilization now accepts serviceCodes (an array) in
addition to the single serviceCode. It sweeps all requested services in one
run — acquiring the per-model lock once — and writes one utilization snapshot
per service. Passing a single serviceCode is unchanged and fully
back-compatible. Duplicate service codes are de-duplicated.
Added: Per-profile fault tolerance. A single unreachable account (expired
credentials, AccessDenied, throttling) no longer aborts the whole sweep. The
failure is recorded in a new failedProfiles field and the snapshot is still
emitted, so a large multi-account run degrades gracefully instead of producing
nothing. failedProfiles was added to the utilization resource and the new
pendingRequests resource. Persisted error text has ARNs and account ids
redacted.
Upgrade note: One new IAM permission is required for list_pending_requests:
servicequotas:ListRequestedServiceQuotaChangeHistory. Existing methods are
unaffected — the permission is only needed if you call the new method.
Modified 1 models
2026.07.04.1
Added: get_request_status method — check the status of a previously
submitted quota increase request using GetRequestedServiceQuotaChange API.
Returns the current status, case ID, desired value, and timestamps.
Added: get_case_communications method — retrieve support case
correspondence for quota increase requests. Uses the AWS Support
DescribeCases and DescribeCommunications APIs. Requires AWS Business or
Enterprise support plan.
Added: caseCommunications resource spec storing case metadata (subject,
status, severity) and the communications array.
Upgrade note: Two new IAM permissions required for get_case_communications:
support:DescribeCases and support:DescribeCommunications. Existing methods
are unaffected — the new permissions are only needed if you call the new method.
Add get_case_communications method for retrieving support case correspondence on quota increase requests
Modified 1 models
Add get_request_status method for checking quota increase request status
Modified 1 models
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned