Multi-Cloud CLI Guide — MyAdminDesk

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A command is a draft until the account matches

The CLI guides you to one tool: the AWS CLI, the Azure CLI, or gcloud. The builders draft a command from choices you type. They do not run it. You run it later, if you run it, only in an account you administer.

A profile and a region are part of the command's meaning. A command without them is a command aimed at whatever the laptop last used. Write both in the ticket before you trust a line.

An access key does not belong in the command you save, in the shell note, or in the ticket. The profile points at the store. prompt-for-this is the reminder in a sample. It is not a key.

Three clouds in one hour is how a lab prompt lies to you. Pick the provider guide that matches the one CLI. The others wait.

One profile, one region, one read-only draft

Choose the CLI that matches the lab account. Draft a command that reads a name, such as the caller identity or the project id. Read it aloud with the profile and the region. If either is missing, the draft is not done.

The first command you intend to run is a read. A create belongs to the provider guide after the network drawing exists. Do not use this page to invent a create against production.

Write how you will notice the wrong account. The identity string in the output must match the ticket. If it does not, you stop. You do not 'just this once' continue.

History and scrollback are copies. If a secret ever appeared there, rotate it and clear the line. The note stores the command with the secret removed.

# CLI note. A builder draft is not a running command.
# One CLI. Profile and region written.
# The first command reads. It does not create.
# prompt-for-this is not an access key.
# Stop if the identity is not the lab in the ticket.

A change you can finish

Running the read command is a short lab step when the profile is ready. Creates wait.

Rollback of a read is nothing. That is why the first command reads. A create you did not mean has whatever rollback the provider guide already required, which is why you did not create.

Pick one CLI.
Write the profile and the region.
Draft a read of the identity or the project.
Remove any secret from the line.
Run it only when the window says so, and compare the identity.
Stop if the account is wrong.
Hand creates to the provider guide.

Mistakes that outlive the command

multi-cloud CLI fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

A command aimed at the laptop's last profile.
A key pasted into the ticket.
A create as the first command.
Continuing when the identity does not match.
Three CLIs in one hour.
A command against an account you do not administer.
A secret left in shell history.
Using the builder output without reading the region.
A production change disguised as a syntax test.
No record of the identity string.

Decisions to write down before the window

One decision for multi-cloud CLI: One CLI is chosen. The profile is named. The region is named. The draft reads identity. No secret is in the line. The expected identity is written before you run. A mismatch is a stop. Creates are not this page. The matching provider guide is next. The other two CLIs wait. History is clean of secrets. And a second person can see the profile name.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for multi-cloud CLI. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. multi-cloud CLI is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

CLI checks before a second command

Confirm this before you call the change done: The profile and region are in the ticket. The draft is a read. The expected identity is written. The output matched, or you did not run it yet. No key is in the note. The account is yours. No create ran. One CLI only. The provider guide is named. Shell history has no secret from this hour. A second person read the profile. The next command is still unwritten. The hostname in the prompt matches the hostname in the ticket for multi-cloud CLI. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for multi-cloud CLI happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.