skills.rest
obispobruno
obispobrunoCOMMUNITY
Explore all skills by this author →
GitHub

setup-security-agent

Provisions AWS Security Agent workspace resources including agent space, IAM role, and S3 bucket.

1|Updated Aug 1, 2024
Search Tags:#aws#setup#cloud security#provisioning#iam role#security agent#s3 bucket
One-click install
npx skills add https://github.com/obispobruno/dotfiles --skill setup-security-agent-obispobruno
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: setup-security-agent
Source: https://github.com/obispobruno/dotfiles/tree/main/dot_agents/skills/setup-security-agent
Command: npx skills add https://github.com/obispobruno/dotfiles --skill setup-security-agent-obispobruno

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Before running any AWS security scan or pentest, the workspace needs an agent space, an IAM service role, and an S3 bucket correctly linked together. This Skill automates that one-time provisioning so scans can start immediately without manual AWS console work. ## Core Features & Use Cases - Agent Space Provisioning: Reuses an existing agent space (with user confirmation) or creates a new one via the AWS Security Agent API. - IAM Role Setup: Creates the SecurityAgentScanRole with a trust policy for securityagent.amazonaws.com including the aws:SourceAccount confused-deputy guard, plus S3 and CloudWatch Logs permissions. - S3 Bucket Hardening: Creates the convention-named bucket with public access block, 30-day lifecycle expiration, and bucket-ownership enforcement via --expected-bucket-owner to defend against bucket-squatting. - Use Case: A developer runs their first security scan on a new repo; the Skill detects missing config, provisions all AWS resources idempotently, and persists minimal state to .security-agent/config.json. ## Quick Start Ask the AI to set up the security agent for this workspace before running any scan or pentest.

Frequently Asked Questions about setup-security-agent

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up AWS Security Agent for the first time?▼

Run the setup skill, which checks for existing state in .security-agent/config.json, then provisions an agent space, the SecurityAgentScanRole IAM role, and a convention-named S3 bucket. It persists only the agent space ID and region, deriving other values by convention.

What AWS resources does the security agent setup create?▼

It creates three resources: an agent space via the securityagent API, an IAM role named SecurityAgentScanRole with S3 and CloudWatch Logs permissions, and an S3 bucket named security-agent-scans-<account>-<region> with public access blocked and a 30-day lifecycle rule.

Can I reuse an existing agent space instead of creating a new one?▼

Yes. The setup lists existing agent spaces and asks which one to reuse, never auto-selecting. If you choose an existing space, its ID is stored in config.json and the role and bucket are merged into its registered AWS resources.

Why does setup fail with 403 Forbidden or BucketAlreadyExists on the S3 bucket?▼

The bucket name is derived from your account ID and region, so another account can pre-register it (bucket-squatting). The setup treats a 403 or BucketAlreadyExists on a foreign-owned bucket as fatal and aborts without uploading anything.

What happens if the SecurityAgentScanRole IAM role already exists?▼

The setup handles EntityAlreadyExists by falling through to update-assume-role-policy, ensuring the trust policy allows securityagent.amazonaws.com with the aws:SourceAccount guard. Permissions are always reapplied via put-role-policy, making the process idempotent.

Can I use a custom IAM role or S3 bucket name with the security agent?▼

Not directly. The related scan and pentest skills derive the role ARN and bucket name by convention rather than reading them from config, so custom names require extending the skills themselves rather than just changing setup parameters.

Related Skills

Explore More Software Engineering Skills→
awsaws
2.5k

setup-security-agent

Configure AWS Security Agent workspace with agent space, IAM role, and S3 bucket.

Official
Advanced
AndreKuraitAndreKurait

scanning-with-aws-security-agent

Upload code to AWS Security Agent and return ranked findings with remediation guidance.

Community
Advanced
devCharuzudevCharuzu

cloud-security

Analyze AWS, Azure, and GCP cloud configurations for misconfigurations and exposure risks.

Community
Intermediate
AradotsoAradotso
5

infrastructure-cicd-data-engineering

Automate Terraform-based AWS infrastructure deployment via GitHub Actions and OIDC.

Official
Advanced