setup-security-agent

To set up an AWS security scanning workspace, you provision an agent space, an IAM role, and an S3 bucket. This links the resources together to enable automated pentests and scanning workflows across multiple AWS accounts.

Configuring an IAM role for AWS security scanning requires creating a deterministic role, such as SecurityAgentScanRole, linked to an S3 bucket. This registers resources on an agent space to enable pentests across AWS accounts.

To ensure your S3 security scans bucket stays private, enforce safety guardrails that block public access. Applying S3 lifecycle rules also helps by auto-deleting uploaded scan data after 30 days to maintain security.

Yes, you can reuse existing IAM roles and S3 buckets when provisioning a security agent. The process supports idempotent provisioning, safely reusing existing resources or creating new deterministic ones to minimize drift.

Multi-account AWS security scanning handles local state by persisting workspace configuration in a .security-agent/config.json file. It computes account and region values on the fly to minimize drift and support multi-account setups.

Your security agent setup creates a .gitignore file to prevent committing local state into version control. It persists workspace-local state under the .security-agent directory and generates the .gitignore when needed to protect sensitive configuration.