Threat Modeling With AWS Security Agent
Run an AWS Security Agent threat model review on spec/design documents.
Install
npx skills add aws/agent-toolkit-for-aws --skill threat-modeling-with-aws-security-agent -g -a claude-code -y- Repository
- aws/agent-toolkit-for-aws3.4k
- Category
- Design
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Lightabout 1,005 tokens
- Runs scripts
- No, instructions only
What it does
Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.
AWS Security Agent, Threat Model Review
Analyze spec documents (requirements.md, design.md) against the source code to identify security-posture changes using STRIDE methodology. No prior scan needed.
Local state
Read .security-agent/config.json for agent_space_id and region. If missing, run the setup-security-agent workflow inline first.
Resolving the values you need
| Placeholder | How to resolve |
|---|---|
<id> (agent space) | config.agent_space_id |
<region> | config.region (default us-east-1) |
<account> | aws sts get-caller-identity --query Account --output text |
<role-arn> | arn:aws:iam::<account>:role/SecurityAgentScanRole |
<bucket> | security-agent-scans-<account>-<region> |
Workflow
-
Pre-checks. Read config, verify agent space, resolve values.
-
Collect spec files. Identify the
requirements.mdand/ordesign.mdthe user is working on. Use absolute paths. Ask if unclear which files to review. -
Zip the workspace (same exclusions as code scan):
cd <absolute-workspace-path> zip -r /tmp/source.zip . \ -x ".git/*" -x ".security-agent/*" -x "node_modules/*" \ -x "__pycache__/*" -x ".venv/*" -x "venv/*" \ -x "dist/*" -x "build/*" -x "target/*" \ -x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \ -x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc" -
Upload source zip:
SCAN_ID="tm-$(date +%s)-$(openssl rand -hex 3)" WORKSPACE_ID=$(printf '%s' "$(pwd)" | md5sum | cut -c1-12) aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip --expected-bucket-owner <account> -
Upload spec files:
