agent-bom discover aws

This Skill addresses the challenge of quickly inventorying AI Agent and MCP-related assets within an AWS cloud environment. Operations and development personnel often need to understand what resources exist in their account, such as Bedrock Agents, ECS services, SageMaker endpoints, Lambda functions, EKS clusters, Step Functions state machines, EC2 instances, and more. However, manually traversing the console or writing scripts is time-consuming and results in inconsistent output formats. This Skill automatically discovers these resources via read-only AWS SDK calls and generates a JSON inventory compliant with the agent-bom specification, providing a standardized data foundation for subsequent security scanning, cost analysis, and compliance audits.

Usage is straightforward. You simply need to ensure Python 3.11+ and the agent-bom library are installed locally, and AWS credentials are configured (it's recommended to use short-term credentials obtained via AWS SSO, WebIdentity, or STS). You can then trigger a scan using natural language instructions (e.g., "Inventory all AI-related assets in the current AWS account"). The Skill will call AWS STS to verify identity, then sequentially query resources from services like Bedrock, ECS, SageMaker, Lambda, EKS, Step Functions, and EC2, ultimately writing the inventory to a JSON file you specify. You have full control over whether to pass this inventory to agent-bom for deep scanning.

It is well-suited for operations engineers and agent developers managing multi-cloud AI infrastructure. Particularly for teams already using agent-bom for full lifecycle management of AI assets, this Skill enables rapid acquisition of standardized AWS-side inventories, unifying the format with inventories from platforms like GCP and Azure to achieve cross-cloud asset visibility and compliance auditing. For security auditors, it can also help identify unauthorized AI service deployments, reducing security risk.

It is recommended to first use the agent-bom trust command to confirm the required scope of read-only IAM permissions and ensure credentials are short-lived. Note that this Skill performs discovery operations only; it will not modify any AWS resources or send credentials or data to third-party services. The generated JSON inventory automatically redacts fields that may contain credential patterns. For regular inventory needs, you can integrate it into CI/CD pipelines, using scheduled tasks to automatically generate reports.