agent-bom discover aws

This Skill addresses the challenge of quickly discovering and inventorying AI agent and MCP-related assets within an AWS cloud environment. In practical operations or security audits, teams often need to understand what Bedrock agents, ECS services, SageMaker endpoints, Lambda functions, EKS clusters, Step Functions state machines, EC2 instances, and other resources are deployed in their AWS accounts. Manually querying each resource is time-consuming and prone to omissions. This tool automatically scans these resources and outputs a standardized agent-bom inventory JSON, providing a unified data foundation for subsequent dependency analysis, security scanning, and compliance audits.

Usage is straightforward. You only need to ensure Python 3.11+ and the agent-bom package are installed locally, and that AWS credentials are configured (using AWS SSO, WebIdentity, or short-term credentials generated via STS is recommended). You can then trigger the tool with a natural language instruction (e.g., "Inventory all AI-related resources in my AWS account"). The tool will call the AWS SDK for read-only queries and write the results to a JSON file you specify. The entire process does not require handing long-term credentials to agent-bom; the data flow is entirely controlled by the operator, who can choose whether to pass the inventory to agent-bom for further scanning.

It is well-suited for operations engineers, agent developers, and security auditors managing multi-cloud AI infrastructure. This is especially true for teams already using agent-bom for dependency management and security scanning, as they can use this tool to quickly generate standardized asset inventories, bridging the complete workflow from resource discovery to risk analysis. For organizations needing to regularly audit AWS AI resource usage, this Skill can significantly improve inventory efficiency and accuracy.

It is recommended to first use the agent-bom trust command before initial use to confirm the required scope of read-only IAM permissions and ensure the AWS credential chain is correctly configured. Note that it primarily relies on the AWS SDK's read-only APIs and will not modify any existing resources; credential pattern values are automatically redacted in the generated inventory JSON. If an account contains a large number of resources, scanning region by region is advised to avoid API throttling.