​

AWS — Discovery

Connect your AWS account (or your whole AWS Organization) so SecureAI can inventory Amazon Bedrock and AgentCore agents, models, and resources, along with the IAM identities that can invoke them, the audit events, usage, and cost that surround them.

​

What SecureAI imports

For each account and each region you choose:

• Agents: Bedrock Agents (classic) and their aliases, and AgentCore runtimes, with their gateways and memories.
• Bedrock resources: knowledge bases, guardrails, custom and imported models, provisioned throughput, and inference profiles (system and application).
• SageMaker: real-time inference endpoints and models.
• Model-invocation logging: whether it is enabled in each region. Off means prompts are not recorded, and it is shown as a gap.
• Usage over the last 30 days per model, from CloudWatch: invocations, input and output tokens, and errors.
• Cost of Bedrock over the last 30 days, from Cost Explorer: by region and, in AWS Organizations mode, by linked account.
• Audit: CloudTrail events of Bedrock and AgentCore over the last 30 days (up to 100 per source and region).
• NHIs: IAM users and their access keys with last use (date, service, and region); IAM roles that AI services (Bedrock, AgentCore, SageMaker) can assume, and roles or users whose policies allow invoking Bedrock, with each role’s last use. The model each identity used comes from CloudTrail, when that read was complete. Shown in the NHI Inventory.
• Who can invoke Bedrock: an access map that tells explicit grants apart from wildcards (*, bedrock:*, NotAction), and the effective access of each of those identities according to the IAM policy simulator.
• Bedrock used outside SecureAI: the identities that invoked Bedrock models without going through SecureAI, with model, region, volume, and date. See Bedrock used outside SecureAI.

​

Prerequisites

A read-only role in your account that SecureAI assumes with your organization’s External ID. SecureAI’s CloudFormation template creates it as SecureAI-Discovery, with these permissions: GetAgent and GetKnowledgeBase let SecureAI read an agent or knowledge base by the id CloudTrail names when the listing itself is blocked. iam:SimulatePrincipalPolicy only evaluates policies: it changes nothing in the account. If you deployed the stack before iam:SimulatePrincipalPolicy and the SageMaker permissions were added, update the stack with the new template. Until then, effective access and SageMaker show up as optional gaps naming the missing action. To deactivate access keys from SecureAI (optional), deploy the stack with AllowRevokeAccessKeys=true: it adds iam:UpdateAccessKey on the account’s IAM users. It is off by default. Nothing is skipped silently: whatever SecureAI cannot read is listed with the IAM action that fixes it. See Coverage gaps.

​

Connect

1. Go to Admin → Agent Registry → Cloud Sensors and click Connect AWS (or, once connected, AWS connection). The same connection is under Admin → Integrations → Cloud → AWS Bedrock.
2. On the Connection tab, leave SecureAI role (recommended) selected. The drawer shows the SecureAI principal ARN and your External ID (unique to your tenant).
3. Deploy the SecureAI stack in your AWS account: with Launch Stack in AWS (when offered), or with Download template and the AWS CLI command shown in the drawer (it already includes your parameters). If you already deployed the stack for inference with the discovery role included, you do not need to repeat it. If your organization does not allow CloudFormation, create the SecureAI-Discovery role by hand with the same trust policy shown in the inference guide and the actions in the table above on "Resource": "*".
4. Paste the stack’s DiscoveryRoleArn output into Discovery role ARN (for example arn:aws:iam::123456789012:role/SecureAI-Discovery).
5. Under Regions, enter the regions where your Bedrock and AgentCore resources live, comma-separated (for example us-east-1, eu-west-1). IAM and Cost Explorer are global.
6. Click Test and connect. SecureAI checks the connection with a real read before saving.
7. Sync now with the refresh button. After that, SecureAI syncs automatically every 6 hours.

​

Alternative: IAM user access key

Instead of the role, you can use an IAM user’s Access key ID and Secret access key (plus an optional Session token for temporary credentials). Give the user the same read-only permissions as the role. SecureAI stores the secret encrypted. We prefer the role: it stores no secret and is revoked by deleting the stack. Submitting the form again replaces the configuration, and the stored credential of the other method is dropped.

​

AWS Organizations mode (optional)

To read every account in your organization with a single connection:

1. Deploy the stack in the management account (or a delegated administrator account) and paste that role’s ARN.
2. Deploy the same template to the member accounts with a CloudFormation StackSet, with the same External ID. Member accounts only need the discovery role: use EnableInference=false. The role must have the same name in every member account.
3. Turn on AWS Organizations mode — read every account.

SecureAI lists the organization’s ACTIVE accounts and assumes the role directly in each member account. An account SecureAI cannot read is listed as a gap, and nothing of it is retired or pruned. If the role you pasted is in a member account, the connection says so and names the management account to deploy it in.

​

Verify

• Cloud Sensors lists the discovered agents. Click the AWS card to open AWS Bedrock — Insights: Bedrock usage and cost, agents (Bedrock Agents and AgentCore runtimes), what is wired to them (aliases, knowledge bases, guardrails, gateways and memories, throughput, profiles, and SageMaker endpoints), the accounts and regions read with their invocation logging, access keys, IAM roles, Bedrock used outside SecureAI, Who can invoke Bedrock, Effective access, and CloudTrail activity.
• The NHI Inventory shows the users, access keys, and roles.

If a sync fails (for example, the stack was deleted), the card shows the error and SecureAI retries with backoff, keeping the last inventory. A partial read never retires agents or removes identities.

​

Bedrock used outside SecureAI

From the CloudTrail events it already reads (InvokeModel, InvokeModelWithResponseStream, Converse, ConverseStream, and the OpenAI- and Anthropic-compatible APIs of bedrock-runtime), SecureAI separates the calls made by its own inference identity — the role or access key of the Amazon Bedrock — Inference on your account connection — from the calls made by any other identity. Those other calls went through no DLP, model policy, or signed receipt. Under Identity & Access → Bedrock used outside SecureAI you see, per identity:

• the IAM role or user (and the access key, masked, when it was a long-lived key);
• the models it invoked and how many times each;
• the account and regions;
• the total calls and when it was last seen.

It is also an Insights finding (Amazon Bedrock is being used outside SecureAI): critical when the caller is an IAM user access key or the root account, moderate when it is a role. Details:

• SecureAI recognizes its inference identity by the role ARN or access key ID it has configured, never by the session name: a role with the same name that is not the configured one is still reported.
• If SecureAI has no Bedrock inference connection, every invocation is outside SecureAI.
• CloudTrail is read up to 100 events per source and region. When that cap was reached (or a region could not be read), calls are shown with +: they are a minimum, not the total.
• Failed calls (for example, AccessDenied) do not count as use.

​

Coverage gaps

If the panel says Discovery could not read everything, each line names the surface that was missed, the exact IAM action, the account and region, and how to fix it: When a listing is denied but direct reads work (for example, bedrock:ListAgents blocked and GetAgent allowed), SecureAI says so and reads the resources CloudTrail names.

​

Cost

• The cost is the actual Amazon Bedrock spend according to Cost Explorer, over the last 30 days, by region and, in AWS Organizations mode, by linked account.
• AWS bills **US$0.01 for each Cost Explorer request**. SecureAI makes **one per sync**: with the automatic sync every 6 hours, that is about US$1.20 a month, plus any manual syncs.

​

Access-key revocation

With AllowRevokeAccessKeys=true in the stack, IAM access keys can be deactivated from the NHI Inventory (padlock), and reactivated later: Safeguards:

• SecureAI refuses to deactivate the access key its own connection uses (that would cut discovery off) and the access key of the Bedrock inference connection (that would stop every governed call). Rotate them in IAM. If SecureAI cannot check which key the inference connection uses, it deactivates nothing.
• IAM roles are monitored, but not revoked from SecureAI.
• Without AllowRevokeAccessKeys=true, the error says iam:UpdateAccessKey is missing and how to update the stack.

​

Automatic NHI policies

The automatic NHI policies (NHI Inventory → Automatic policies) also apply to AWS access keys, with the same rules as Google Cloud service-account keys: In Revoke mode the cut is the same as the manual one: the key is set to Inactive and can be reactivated. The same safeguards apply: simulation on by default, a revocation cap per run, only over complete listings, exclusions, and never the keys SecureAI itself uses (discovery and inference). IAM roles are never cut. To revoke SecureAI’s access to your account, delete the stack (or the SecureAI-Discovery role).

​

Related

• Amazon Bedrock — Inference on your account
• Cloud AI Providers Overview
• Cloud Sensors
• NHI Inventory