Every AWS service.
One tool.
The old paradigm is out. The new paradigm is AI. AI automation is InTouch AI — and a general AI-native engine eats the specialized cloud tool. InTouch AI wraps the AWS CLI v2 as a first-class tool — every service, every command, every region. No per-service plugins to add, no SDK stack to maintain. Google Workspace (Drive, Sheets, Docs, Gmail, Calendar), Docker container execution, and the spawn tool for anything the CLI can do complete the cloud-automation surface. One engine reaches every cloud; a single-cloud point tool can't grow that center.
What Actually Ships
AI isn't bolted on the side of these tools — it's the architecture they sit behind. The vault, the scheduling, the audit trail wrap every command below. That's why one engine covers AWS, Google, Docker and Kubernetes without a plugin marketplace: there's a center to reach from.
AWS (CLI v2)
S3, EC2, Lambda, DynamoDB, RDS, ECS, ECR, SQS, SNS, Secrets Manager, Systems Manager — anything the CLI can do, InTouch AI can schedule. Credentials via the vault; assumed-role support; region routing per tool.
Google Workspace
Drive file ops, Sheets read/write, Docs export, Gmail send/search, Calendar. Service-account authentication. Wraps the Google Workspace gcloud CLI and native APIs.
Docker
Run any container as a tool. Mount volumes, set env vars, read stdout/stderr, capture exit codes. The escape hatch for any tool that ships as a container — which, in 2026, is most of them.
Azure / GCP via Spawn
No native Azure or gcloud tool today — use the spawn tool to invoke the az or gcloud CLI with credentials sourced from the vault. Same audit trail as a native tool.
HTTP / REST
Any cloud or SaaS REST API. Inline credentials or vault references, header templates, JSON body templates, response-to-property extraction.
Kubernetes via Spawn
kubectl through the spawn tool with a kubeconfig from the vault. Deploy rollouts, run jobs, inspect pod logs — all orchestrated from InTouch AI.
What Teams Actually Build
Every pattern below is a contract, now intelligent: what to run, when, what to do when it works, what to do when it doesn't, and who to notify. The "doesn't work" clause isn't a dumb retry-N-times-and-email-a-log rule anymore. It reads the failure — an expired AWS token, a throttled API, a container that exited non-zero — knows why, smart-retries or refreshes the credential, and surfaces the one sentence that matters. It broke. Here's why. I fixed it. No config-era cloud scheduler can say that.
Scheduled S3 → DB
Pick up new objects from an S3 prefix (folder trigger via the AWS tool), parse with the DataFrame tool, load into the warehouse. Move processed files to an archive prefix. Alert on parse failures.
Periodic Cost Report
Call aws ce get-cost-and-usage on a Weekday schedule, pipe into a DataFrame transform, email the Top-10 line items to finance. Turn the determinism dial: swap Anthropic for Ollama if account data must never leave the network, or graduate the whole job to zero-AI-cost and identical-every-time once it's earned your trust.
Container-Based ETL
Use Docker to run dbt, Great Expectations, or any internal container image. Pipe outputs between tools; alert on exit-code != 0. A CI system's cousin, built for recurring work.
Google Sheets Sync
Pull a Sheet into a DataFrame, enrich rows via an AI call, write the result back. Schedule hourly during business, cutoff at 18:00.
Cloud Credentials Belong in a Vault, Not a File
This is the trust floor. Every cloud credential — AWS access keys, GCP service-account JSON, Docker registry tokens — lives in the AES-256 encrypted credential vault, referenced by name, never pasted into a script, never exposed even to the AI itself. Never in ~/.aws/credentials on a server someone forgot about. RBAC on the credential object controls who can run jobs that resolve it.
Cloud Automation, Without the SaaS Relay
One AI-native engine for every cloud, self-hosted, credential-safe, audit-logged — proven in Fortune 500 production for 25+ years before "AI automation" was a phrase. Free Personal edition.