# AWS CLI Pin + `/dev/null` Safety Checklist (July 2026)

Incident window: AWS CLI v2 merged **#10196** (“Tighten output file permissions”) ~2026-04-09; reverted by **#10215** on 2026-04-10 after `/dev/null` (and other non-regular paths) were chmod’d to `0600`.

## Immediate host check

```bash
ls -la /dev/null
# healthy: crw-rw-rw-
# broken:  crw-------  →  sudo chmod 0666 /dev/null
aws --version
```

## Pipeline hygiene

- [ ] Never pass `/dev/null` as a CLI **output file argument** — use shell redirection (`> /dev/null`)
- [ ] Pin CLI in CI: `pip install 'awscli==X.Y.Z'` (or official installer digest), not floating `latest`
- [ ] Stage/canary CLI upgrades 24h before production runners
- [ ] Prefer `--cli-read-timeout` / structured logging over discarding to device files when debugging

## If you write tools that chmod user paths

Only `chmod` after `stat.S_ISREG()` (or equivalent). The 2026-04-10 fix was a **full revert**; any future hardening must include the type check.