Back to catalog / Agent workflows
Audit AWS resource compliance read-only
In a read-only sandbox, retrieve AWS best practices, inspect resource configuration, and produce evidence-backed findings and remediation suggestions.
Goal
Produce a resource-compliance audit report for an AWS account without applying changes.
Steps
- Use the sample sandbox Terraform to create an isolated EC2 instance and read-only IAM role; grant no write permissions. [src10-strands-audit-aws-resource-compliance-readonly]
- Let Documentation Retriever find AWS best practices, then have Boto3 Code Assistant issue read-only API queries for Resource Auditor to compare. [src10-strands-audit-aws-resource-compliance-readonly]
- Save each finding’s resource ID, configuration evidence, rule citation, and suggested fix; open a separate change request after human review. [src10-strands-audit-aws-resource-compliance-readonly]
How to verify
Sample-check each finding for an AWS resource ID, read-only response field, and matching best-practice citation; confirm the audit role has no write policy.
Troubleshooting
For API denials, inspect sandbox role and region scope; if a remediation lacks a documentation citation, rerun Documentation Retriever and do not call a write API.
Permissions
Prerequisites
- An AWS test account, the sample read-only sandbox Terraform, Bedrock model access, and sample dependencies.
Permissions
- The setup Terraform creates sandbox EC2, IAM, and other AWS resources and incurs charges; review terraform plan separately before applying it. At audit runtime the agent reads account resources and AWS documentation and calls a model; its audit role should be read-only, never a production-admin credential.
Limitations
The sample offers recommendations, not complete framework coverage; Terraform creates test infrastructure, while the auditor must not modify account resources.
Pinned upstream source
- Repository
- strands-agents/samples
- File path
- python/04-industry-use-cases/software-engineering/aws-audit-assistant/README.md
- Pinned commit
bd46f959844424a9544133e1263c8eae61e7fe9b- Source checked
- 2026-10-14 · Reviewed against the pinned upstream source
Repository metrics
These values describe the upstream repository, not popularity or likes for an individual skill or playbook.
- Stars
- Not collected
- Forks
- Not collected
- Observed at
- Not collected
No metrics snapshot is available yet.
License: Apache-2.0
Main topic
Make Agent behavior safer and easier to verify