agent-bom discover aws

This Skill addresses the challenge of quickly discovering AI Agent and MCP-related assets within an AWS environment and generating a standardized inventory. In real-world operations or development, teams often need to understand what Bedrock Agents, ECS services, SageMaker endpoints, Lambda functions, EKS clusters, Step Functions state machines, or EC2 instances are deployed under their current account. However, manually gathering resource information scattered across various service consoles is time-consuming and prone to omissions. This Skill performs a single read-only scan to automatically aggregate all AI-related infrastructure, outputting a JSON inventory compliant with the agent-bom specification. This provides a unified data foundation for subsequent dependency analysis, security audits, or cost optimization.

Usage is straightforward. You simply need to ensure Python 3.11+ and the agent-bom tool are installed locally, and configure valid AWS temporary credentials (recommended via AWS SSO, WebIdentity, or STS). You can then trigger the scan using a natural language instruction (e.g., "Inventory all Bedrock Agents and ECS services in the current AWS account"). The Skill calls the AWS SDK's read-only APIs to query each service sequentially, ultimately writing the results to a JSON file you specify. The entire process does not require handing long-term cloud credentials to a third party, and the data flow remains entirely within the operator's local control.

It is well-suited for operations engineers, agent developers, and platform architects managing multi-cloud or large-scale AWS infrastructure. Teams already using agent-bom for AI asset inventory management can seamlessly integrate this Skill's output for direct dependency analysis, policy assessment, or compliance checks. For enterprises building AI Agent platforms, this Skill helps quickly assess their existing assets, avoiding resource redundancy or security blind spots.

It is recommended to first use the agent-bom trust command to confirm the required scope of read-only IAM permissions and ensure the AWS credential chain is correctly configured before initial use. Note that this Skill only supports the AWS platform, and the scan scope is limited to regions and resources accessible by the current credentials. Credential pattern values are automatically masked in the output JSON, but operators are still responsible for managing the storage and sharing permissions of the output file.