AWS Security Agent, Penetration Test

This skill handles pentest setup, execution, and findings. Initial Security Agent setup (agent space, role, bucket) is handled by the setup-security-agent skill, if .security-agent/config.json is missing, the pentest workflow auto-runs setup inline first.

Pentests are slow (1-24 hours) and active, they probe a real running app. Always confirm the user is authorized to test the target before starting.

---

Resolving the values you need

The CLI examples below use placeholders. Resolve them at the start of every pentest:

Placeholder	How to resolve
<id> (agent space)	config.agent_space_id
<region>	config.region (default us-east-1)
<account>	aws sts get-caller-identity --query Account --output text (cache for the rest of the turn)
<role-arn>	arn:aws:iam::<account>:role/SecurityAgentScanRole
<td-id>	targetDomainId returned by create-target-domain (cache under config.target_domains[<domain>])
<pentest-id>	pentestId returned by create-pentest
<pj-id>	pentestJobId returned by start-pentest-job

Pre-pentest checks

1. Read .security-agent/config.json. If missing → tell the user one line, "First pentest in this workspace, running setup first.", and run the setup-security-agent workflow inline before continuing.

2. Verify agent space still exists:

   aws securityagent batch-get-agent-spaces --agent-space-ids <id>
   

   If missing, clear agent_space_id from config.json and run setup-security-agent again.

3. Resolve account and role ARN from the table above.

4. Authorization check: ask the user "Do you own or have explicit permission to pentest <target>?" if it's not obvious from context. Do not proceed without confirmation.

---

Workflow

1. Register target domain (one-time per domain)