@@ -10,6 +10,24 @@ import { BlockInfoCard } from "@/components/ui/block-info-card"
   color="linear-gradient(45deg, #B0084D 0%, #FF4F8B 100%)"
 />
 
+{/* MANUAL-CONTENT-START:intro */}
+[AWS CloudTrail](https://aws.amazon.com/cloudtrail/) records who did what in your AWS accounts. Every API call — from the console, the CLI, an SDK, or another AWS service — is captured as an event with the calling identity, source IP, parameters, and result. It is the system of record for security investigation, compliance evidence, and answering "what changed?"
+
+With AWS CloudTrail, you can:
+
+- **Look up recent activity**: Search the last 90 days of management events by user, event name, resource, or event source
+- **Inspect trail configuration**: Describe trails, check logging status, and read the event and Insights selectors that decide what gets captured
+- **Query history with SQL**: Run CloudTrail Lake queries across event data stores for analysis that reaches further back than event lookup
+- **Confirm coverage**: Verify that logging is actually enabled and that multi-region and organization trails are delivering
+
+In Sim, CloudTrail is the audit half of the AWS story. Where IAM and Identity Center answer *who has access*, CloudTrail answers *what they actually did with it* — so an agent can take a suspicious permission change and trace it back to the principal, the source IP, and the moment it happened, then hand a written timeline to whoever needs to act on it.
+
+This block is read-only with one narrow exception: `Cancel Query` stops a running CloudTrail Lake query. It never enables or disables logging, alters trail configuration, or deletes a trail, so it can be granted a `cloudtrail:Describe*/Get*/List*/LookupEvents/StartQuery` policy with no residual write risk. Note that `Start Query` is billed per GB scanned and consumes your account's concurrent-query quota.
+
+`Lookup Events` is limited by AWS to two requests per second per account per Region. The block paces itself against that limit automatically, so broad searches take longer rather than failing.
+{/* MANUAL-CONTENT-END */}
+
+
 ## Usage Instructions
 
 Integrate AWS CloudTrail into workflows. Look up the last 90 days of management and Insights events by user, event name, resource, or access key; inspect trail configuration, logging status, and event selectors; and run SQL queries against CloudTrail Lake event data stores. This block never changes trail or event data store configuration, and never starts or stops logging. Starting and cancelling a Lake query are the only actions that are not reads, and AWS bills Lake queries on the data they scan. Requires AWS access key and secret access key.
 
@@ -19,9 +19,14 @@ With AWS IAM, you can:
 - **Create roles**: Define IAM roles with specific permissions that can be assumed by users, services, or applications for temporary access
 - **Attach policies**: Assign managed policies to users and roles to define what actions they can perform on which resources
 - **Organize with groups**: Create IAM groups to manage permissions for collections of users, simplifying access management at scale
-- **Control access keys**: Generate and manage programmatic access key pairs for API and CLI access to AWS services
+- **Control access keys**: Generate, list, deactivate, and delete programmatic access key pairs for API and CLI access to AWS services
+- **Simulate policies**: Test whether a principal is allowed to perform specific actions against specific resources, before granting or revoking anything
 
 In Sim, the AWS IAM integration allows your workflows to automate identity management tasks such as provisioning new users, assigning roles and permissions, managing group memberships, and rotating access keys. This is particularly useful for onboarding automation, security compliance workflows, access reviews, and incident response — enabling your agents to manage AWS access control programmatically.
+
+Policy simulation deserves a note, because AWS's model is easy to misread. `Simulate Principal Policy` returns one result per action regardless of how many resource ARNs you pass. The top-level decision is the **aggregate** across every resource — most restrictive wins — and the top-level resource name is an ARN *template* for the resource type, not one of your ARNs. Per-resource answers live in `resourceSpecificResults`, and when you supply concrete ARNs, missing context keys are reported there too rather than at the top level. Read `resourceSpecificResults` whenever you simulate against more than one resource: the aggregate alone will tell you a principal is denied when it is in fact allowed on some of them.
+
+The secret half of a new access key is returned once and is hidden from block output display and execution logs. It stays resolvable downstream, so rotation workflows can pass it straight to the system that needs it — but a block you pass it into will log it under that block's own inputs.
 {/* MANUAL-CONTENT-END */}
 
 
 
@@ -21,9 +21,14 @@ With AWS IAM Identity Center, you can:
 - **List permission sets**: Enumerate the available permission sets (e.g., ReadOnly, PowerUser, AdministratorAccess) defined in your Identity Center instance
 - **Monitor assignment status**: Poll the provisioning status of create/delete operations, which are asynchronous in AWS
 - **List accounts in your organization**: Enumerate all AWS accounts in your AWS Organizations structure to populate access request dropdowns
-- **Manage groups**: List groups and resolve group IDs by display name for group-based access grants
+- **Manage groups**: List groups, resolve group IDs by display name, and enumerate group memberships for group-based access grants
+- **Audit an account's access**: List every assignment on a given AWS account, then resolve each principal ID back to the user or group behind it
 
 In Sim, the AWS Identity Center integration is designed to power **TEAM (Temporary Elevated Access Management)** workflows — automated pipelines where users request elevated access, approvers approve or deny it, access is provisioned with a time limit, and auto-revocation removes it when the window expires. This replaces manual console-based access management with auditable, agent-driven workflows that integrate with Slack, email, ticketing systems, and CloudTrail for full traceability.
+
+The same operations support the reverse direction — access review. Starting from an account, an agent can list its assignments, resolve the principals, expand groups into their members, and produce a written report of exactly who can reach that account and through which permission set.
+
+Two AWS behaviors are worth knowing. Creating and deleting an account assignment are **asynchronous**: both return a request ID, and each has its own status poller — use *Check Assignment Status* for creations and *Check Assignment Deletion Status* for deletions, as the two request-ID types are not interchangeable. And the account-listing operations call AWS Organizations, which is global per partition; the block resolves the correct endpoint for commercial, GovCloud, and China regions automatically.
 {/* MANUAL-CONTENT-END */}
 
 
 
@@ -21,11 +21,14 @@ With Amazon SQS, you can:
 - **Ensure reliability**: Built-in redundancy and high availability
 - **Support FIFO queues**: Maintain strict message ordering and exactly-once processing
 
-In Sim, the SQS integration enables your agents to send messages to Amazon SQS queues securely and programmatically. Supported operations include:
+In Sim, the SQS integration gives your agents both sides of the queue — producing work and consuming it. Supported operations cover:
 
-- **Send Message**: Send messages to SQS queues with optional message group ID and deduplication ID for FIFO queues
+- **Messages**: Send one message or a batch of up to 10, receive with long polling, delete individually or in batches, and extend visibility timeouts while work is still in flight
+- **Queues**: Create, delete, and purge queues, look up a queue URL by name, and read or update queue attributes
+- **Dead-letter handling**: List the source queues feeding a dead-letter queue, then start, monitor, and cancel message move tasks to redrive failed messages back
+- **Tags**: List, add, and remove queue tags for cost allocation and ownership tracking
 
-This integration allows your agents to automate message sending workflows without manual intervention. By connecting Sim with Amazon SQS, you can build agents that publish messages to queues within your workflows—all without handling queue infrastructure or connections.
+Because an agent can now drain a queue rather than only fill it, SQS becomes a way to hand work to Sim as well as from it. A workflow can long-poll a queue for jobs, process each message, delete it on success, and let the visibility timeout return anything it fails to finish — the standard reliable-consumer pattern, without running a worker of your own.
 {/* MANUAL-CONTENT-END */}
 
 
 
@@ -10,6 +10,24 @@ import { BlockInfoCard } from "@/components/ui/block-info-card"
   color="#E7157B"
 />
 
+{/* MANUAL-CONTENT-START:intro */}
+[AWS Systems Manager](https://aws.amazon.com/systems-manager/) is the operations hub for AWS. It gives you a single place to run commands across fleets of managed nodes, store configuration and secrets, track patch and compliance state, and execute runbooks — without opening SSH, managing bastion hosts, or distributing long-lived credentials.
+
+With AWS Systems Manager, you can:
+
+- **Run commands remotely**: Execute shell or PowerShell across a fleet by instance ID or tag-based targets, with concurrency and error thresholds you control
+- **Store configuration and secrets**: Keep parameters in Parameter Store as plain strings, string lists, or KMS-encrypted SecureStrings
+- **Inspect your fleet**: List managed nodes with their platform, agent version, and last ping time
+- **Track patch state**: Read per-instance patch installations and summary compliance counts
+- **Audit compliance**: Query compliance items and summaries across your managed nodes
+- **Automate runbooks**: Start, monitor, and stop Automation executions built on SSM documents
+
+In Sim, the Systems Manager integration is what lets an agent act on infrastructure rather than only report on it. Paired with CloudWatch or CloudTrail for detection, a workflow can investigate an alert, run a diagnostic command against the affected nodes, read the configuration behind the failure from Parameter Store, and kick off an Automation runbook to remediate — end to end, with every step logged in your run history.
+
+Parameter Store decryption is opt-in: `Get Parameter` and `Get Parameters` leave `WithDecryption` off unless you explicitly enable it, so a SecureString stays encrypted by default. Written and decrypted values are masked in the block and are kept out of logs, traces, and error envelopes.
+{/* MANUAL-CONTENT-END */}
+
+
 ## Usage Instructions
 
 Integrate AWS Systems Manager into your workflow. Run commands on managed nodes, read and write Parameter Store values, inspect node inventory and patch compliance, and drive Automation runbooks.