I Built an AI Agent That Audits AWS (And It Can't Touch Anything)
An AI agent just read my AWS account and told me a bucket was open to the internet, SSH was exposed to 0.0.0.0/0 , GuardDuty was off, and I was burning $3.65 a month on an Elastic IP attached to nothing. It did all of that in about two minutes. And here is the part that counts: it physically could not have changed anything even if it tried. That last sentence is the whole point of this build.…
The AI agent read the user's AWS account and identified several security issues and costs, such as an open bucket, exposed SSH, GuardDuty being disabled, and an Elastic IP attached to nothing. The agent accomplished all this in about two minutes. However, it could not have made any changes even if it attempted to. This demonstrates the core purpose of the agent's build.
The agent operates on a read-only IAM identity, preventing it from making any modifications. Each potential write command is rejected by AWS before execution. The guide provides a walkthrough of creating this agent from scratch, consisting of one JSON file and one Markdown checklist. By the end, the user will have a functioning AWS auditor they can use on their own account and understand the functionality behind it.
The resource is available on GitHub: github.com/simplynadaf/aws-auditor-agent. This guide is for users who utilize Kiro Crew or the Amazon Q Developer CLI, possess basic AWS knowledge, and understand AI agents.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
