Read-Only by Construction: The Guard in Front of Every AWS Call
Most tools say they're read-only because their docs or IAM role say so. A small guard makes it a code property: non-read AWS calls are refused before sending.
AWSSecurityPython
6 min read