diff --git a/stdlib/aws/aws.cue b/stdlib/aws/aws.cue
index 12ed1b1b..1a3663c8 100644
--- a/stdlib/aws/aws.cue
+++ b/stdlib/aws/aws.cue
@@ -18,14 +18,94 @@ import (
 
 // Re-usable aws-cli component
 #CLI: {
+	package: [string]: string
+
 	#up: [
 		op.#Load & {
 			from: alpine.#Image & {
-				package: bash:      "=5.1.0-r0"
-				package: jq:        "=1.6-r1"
-				package: curl:      "=7.74.0-r1"
-				package: "aws-cli": "=1.18.177-r0"
+				"package": package
+				"package": bash:      "=5.1.0-r0"
+				"package": jq:        "=1.6-r1"
+				"package": curl:      "=7.74.0-r1"
+				"package": "aws-cli": "=1.18.177-r0"
 			}
 		},
 	]
 }
+
+// Helper for writing scripts based on AWS CLI
+#Script: {
+	// AWS code
+	config: #Config
+
+	// Script code (bash)
+	code: string
+
+	// Extra pkgs to install
+	package: [string]: string
+
+	// Files to mount
+	files: [string]: string
+
+	// Env variables
+	env: [string]: string
+
+	// Export file
+	export: string
+
+	// Always execute the script?
+	always?: bool
+
+	out: {
+		string
+
+		#up: [
+			op.#Load & {
+				from: #CLI & {
+					"package": package
+				}
+			},
+			op.#Mkdir & {
+				path: "/inputs"
+			},
+			for k, v in files {
+				op.#WriteFile & {
+					dest:    k
+					content: v
+				}
+			},
+			op.#WriteFile & {
+				dest:    "/entrypoint.sh"
+				content: code
+			},
+			op.#Exec & {
+				if always != _|_ {
+					"always": always
+				}
+				args: [
+					"/bin/bash",
+					"--noprofile",
+					"--norc",
+					"-eo",
+					"pipefail",
+					"/entrypoint.sh",
+				]
+				"env": env
+				"env": {
+					AWS_CONFIG_FILE:       "/cache/aws/config"
+					AWS_ACCESS_KEY_ID:     config.accessKey
+					AWS_SECRET_ACCESS_KEY: config.secretKey
+					AWS_DEFAULT_REGION:    config.region
+					AWS_REGION:            config.region
+					AWS_DEFAULT_OUTPUT:    "json"
+					AWS_PAGER:             ""
+				}
+				mount: "/cache/aws": "cache"
+			},
+			op.#Export & {
+				source: export
+				format: "string"
+			},
+		]
+	}
+}