Matches HTTP requests attempting to access the sensitive AWS CLI configuration file /.aws/config. This primitive helps identify reconnaissance or exploitation activity where attackers probe for exposed cloud configuration data, including account profiles, regions, and role settings, typically through path traversal, local file inclusion, or misconfigured web server directory exposure.