agent-bom discover aws
Discover AI assets on AWS and generate standardized inventory
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom discover aws. It is used for: Discover AI assets on AWS and generate standardized inventory Full Skill content: https://321skill.com/skills/agent-bom-discover-aws-x-10/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This skill addresses the lack of a unified standard for inventorying AI Agent and MCP-related assets within AWS environments. In practice, DevOps and Agent developers often need to know what Bedrock Agents, ECS services, SageMaker endpoints, Lambda functions, EKS clusters, Step Functions state machines, EC2 instances, etc., exist under an account. However, manual collection is time-consuming, prone to omissions, and outputs from different tools are inconsistent, making subsequent processing difficult.
Usage is straightforward. Simply run the agent-bom discover aws command in an environment with configured AWS credentials (AWS SSO, WebIdentity, or STS temporary credentials are recommended). It automatically invokes the AWS SDK for read-only queries, scans relevant services in the specified region(s), and ultimately generates a JSON inventory file compliant with the agent-bom specification at your specified path. You can then choose to pass this inventory to agent-bom for further scanning, dependency graph generation, or report export.
It is well-suited for DevOps engineers and Agent development teams managing multi-cloud or large-scale AWS AI infrastructure. Organizations already using agent-bom for asset dependency analysis can particularly benefit, as this skill quickly provides standardized input data, avoiding the tedium and errors of manual inventory creation. For security audit scenarios, it meets compliance requirements by using only read-only IAM policies and not storing long-term credentials.
It is recommended to first use the agent-bom trust command during initial setup to confirm the required list of read-only IAM permissions and ensure Python version ≥3.11. Note that it primarily targets AWS managed services; discovery of self-hosted AI applications on EC2 requires additional configuration. Also, the generated inventory does not include sensitive information (e.g., keys) by default, but it's advised to double-check before transmission or storage.
Key Features
Unlike AWS Config or AWS Resource Explorer, it specifically discovers AI Agent and MCP-related assets (e.g., Bedrock, SageMaker, Step Functions). Its output is in the agent-bom specification JSON format, ready for immediate use in subsequent dependency analysis and policy scanning, without requiring long-term cloud credentials for agent-bom.
Limitations
Requires a Python 3.11+ environment, depends on the agent-bom package (installable from PyPI), and requires the operator to have AWS read-only permissions (short-term STS credentials are recommended). It does not support non-AWS managed AI assets.
FAQ
What AWS permissions are required?
A read-only IAM policy is recommended. Specific permissions can be viewed via the `agent-bom trust` command, typically including bedrock:ListAgents, ecs:ListServices, sagemaker:ListEndpoints, etc.
What format is the output file?
The output is a JSON file compliant with the agent-bom specification, containing source_type=skill_invoked_pull, and can be used directly with the `agent-bom scan` command.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-discover-aws-x-10/raw/index.md to read the original Skill definition (Markdown format) for agent-bom discover aws, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-discover-aws-x-10/raw/index.md