AWS Security Engineers: Build a Read-Only Security Hub Triage Agent

Securing AWS with AI: A Read-Only Triage Agent Strategy

For security teams operating within AWS, the immediate path to integrating AI-powered agents for security tasks involves leveraging existing AWS services rather than building custom infrastructure from scratch. The recommended approach centers on the AWS Agent Toolkit for AWS and the managed AWS MCP Server. This strategy ensures that AI agents can interact with AWS documentation, APIs, and specific AWS skills, all while tethered to the robust security controls of AWS Identity and Access Management (IAM). This is critical because the ultimate enforcement point remains IAM, not the AI model itself.

The initial operating model for such agents must be exceptionally strict. Security teams should implement a read-only posture from the outset. This means denying any production write authority, prohibiting access to secrets, and excluding raw customer Personally Identifiable Information (PII) or sensitive incident logs from prompt contexts. Furthermore, automatic remediation should be disabled, and AI-driven approvals for suppression, exceptions, merges, deployments, or risk acceptance must not be permitted. This cautious approach minimizes the attack surface and prevents unintended consequences while allowing security professionals to explore the capabilities of AI in a controlled environment.

The Practicality of the Managed AWS MCP Server

The decision to start with AWS's managed MCP path and Agent Toolkit is rooted in practicality and security. Building and managing a custom MCP server introduces significant overhead in terms of development, maintenance, and, crucially, security configuration. By opting for the managed AWS solution, teams can offload much of this complexity. The Agent Toolkit itself is designed for plugin-based integration, supporting popular AI models like Claude Code and Codex. This allows security engineers to quickly deploy and configure agents without deep expertise in AI model orchestration or custom API development.

The core benefit here is that the managed services are built with AWS's security best practices in mind. They are designed to work seamlessly with IAM roles and policies. This means an AI agent, when configured correctly, will operate with the least privilege necessary. For a security triage agent, this translates to the ability to query Security Hub findings, analyze CloudTrail logs (if permitted by policy), and access relevant AWS documentation to provide context on alerts, all without the ability to modify resources or access sensitive data it isn't explicitly granted permission to see.

Establishing a Strict Read-Only Operating Model

The foundation of any secure AI integration in a security context is a stringent operating model. For a read-only triage agent, this model dictates:

• Read-Only First: The agent's primary function is observation and analysis. It should only have permissions to view findings, logs, and configuration details. Any attempt to modify resources or settings must be blocked at the IAM policy level.
• No Production Write Authority: Under no circumstances should the agent be granted permissions to make changes to production environments. This includes modifying security group rules, updating IAM policies, or altering resource configurations.
• No Access to Secrets: Sensitive information like API keys, database credentials, or private certificates must be completely inaccessible to the AI agent. Prompt context should never include secrets, and the agent's execution environment should not have access to AWS Secrets Manager or Parameter Store for sensitive data retrieval.
• No Raw Customer PII or Sensitive Incident Logs in Prompt Context: To protect privacy and sensitive data, the agent should not be fed raw customer PII or detailed incident logs directly into its prompts. If analysis of such data is required, it should be anonymized or aggregated beforehand, and the agent should only process sanitized versions.
• No Automatic Remediation: The agent's role is to assist human analysts, not to act autonomously. Automated remediation actions, especially in a security context, carry inherent risks. The agent should flag potential issues and provide recommendations, but the decision and execution of remediation must remain with a human operator.
• No AI-Approved Suppression, Exception, Merge, Deploy, or Risk Acceptance: The AI agent should not be trusted with critical decision-making processes such as suppressing alerts, granting exceptions to security policies, merging code changes, deploying infrastructure, or formally accepting security risks. These actions require human judgment and accountability.

This disciplined approach ensures that the AI agent acts as an intelligent assistant, augmenting the capabilities of security engineers by quickly processing vast amounts of data and identifying patterns, rather than becoming a potential vector for misconfiguration or data breaches.

The Role of AWS Security Hub

AWS Security Hub serves as the central aggregation point for security alerts and findings from various AWS services (like GuardDuty, Inspector, Macie) and partner solutions. A read-only triage agent integrated with Security Hub can significantly streamline the initial stages of incident response. Instead of security engineers manually sifting through numerous findings, the AI agent can analyze these alerts, correlate them, and provide a summarized, prioritized view.

For instance, the agent could be prompted to identify all high-severity findings related to EC2 instances in a specific region, cross-reference them with network traffic logs from VPC Flow Logs, and check for any open vulnerabilities reported by Inspector. It could then present a concise report detailing the most critical issues, along with relevant context and potential root causes, all derived from accessible, read-only data sources. This allows engineers to focus their attention on the most pressing threats, rather than spending time on data gathering and initial assessment.

The agent can also be trained on AWS documentation and security best practices. When a new finding appears, the agent can immediately provide links to relevant documentation for understanding the threat and suggest standard operating procedures for investigation, all without requiring write access to any AWS resource.