# Pentesting With AWS Security Agent

Run an AWS Security Agent penetration test against a live web application, registers...

- Repository: https://github.com/aws/agent-toolkit-for-aws (3366 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add aws/agent-toolkit-for-aws --skill pentesting-with-aws-security-agent -g -a claude-code -y`
Codex: `npx skills add aws/agent-toolkit-for-aws --skill pentesting-with-aws-security-agent -g -a codex -y`
Cursor: `npx skills add aws/agent-toolkit-for-aws --skill pentesting-with-aws-security-agent -g -a cursor -y`
Gemini CLI: `npx skills add aws/agent-toolkit-for-aws --skill pentesting-with-aws-security-agent -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add aws/agent-toolkit-for-aws`

## Description

Run an AWS Security Agent penetration test against a live web application, registers and verifies the target domain, exercises the supplied endpoints with the managed Security Agent service, and returns verified runtime findings. Use when the user asks to pentest, run a penetration test, test their app's attack surface, find runtime vulnerabilities, register or verify a target domain, or check pentest status / findings.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# AWS Security Agent, Penetration Test

This skill handles pentest setup, execution, and findings. Initial Security Agent setup (agent space, role, bucket) is handled by the **`setup-security-agent`** skill, if `.security-agent/config.json` is missing, the pentest workflow auto-runs setup inline first.

Pentests are slow (1-24 hours) and active, they probe a real running app. **Always confirm the user is authorized to test the target** before starting.

---

## Resolving the values you need

The CLI examples below use placeholders. Resolve them at the start of every pentest:

| Placeholder | How to resolve |
|-------------|----------------|
| `<id>` (agent space) | `config.agent_space_id` |
| `<region>` | `config.region` (default `us-east-1`) |
| `<account>` | `aws sts get-caller-identity --query Account --output text` (cache for the rest of the turn) |
| `<role-arn>` | `arn:aws:iam::<account>:role/SecurityAgentScanRole` |
| `<td-id>` | `targetDomainId` returned by `create-target-domain` (cache under `config.target_domains[<domain>]`) |
| `<pentest-id>` | `pentestId` returned by `create-pentest` |
| `<pj-id>` | `pentestJobId` returned by `start-pentest-job` |

## Pre-pentest checks

1. **Read `.security-agent/config.json`.** If missing → tell the user one line, "First pentest in this workspace, running setup first.", and run the `setup-security-agent` workflow inline before continuing.
2. **Verify agent space still exists:**

   ```bash
   aws securityagent batch-get-agent-spaces --agent-space-ids <id>
   ```

   If missing, clear `agent_space_id` from `config.json` and run `setup-security-agent` again.
3. **Resolve account and role ARN** from the table above.
4. **Authorization check:** ask the user "Do you own or have explicit permission to pentest `<target>`?" if it's not obvious from context. Do not proceed without confirmation.

---

## Workflow

### 1. Register target domain (one-time per domain)

The rest: https://github.com/aws/agent-toolkit-for-aws/blob/HEAD/plugins/aws-agents-for-devsecops/skills/pentesting-with-aws-security-agent/SKILL.md