I Built an AI Agent That Audits AWS (And It Can't Touch Anything)

A developer has created a read-only AI agent designed to audit AWS accounts for security vulnerabilities and cost inefficiencies. Built using the Kiro Crew framework and the Model Context Protocol (MCP), the agent performs tasks such as identifying public S3 buckets, exposed SSH ports, and unattached Elastic IPs. The project emphasizes security by design; the agent operates under a restricted IAM identity with only 'SecurityAudit' and 'ViewOnlyAccess' permissions, ensuring it is physically incapable of making destructive changes. By utilizing a simple JSON configuration and a Markdown-based checklist, the agent provides prioritized, evidence-based reports without the risks associated with automated write access. The developer has open-sourced the project on GitHub, offering a transparent alternative to heavy-duty compliance tools like Prowler, focusing on actionable, narrative-driven insights for cloud infrastructure management.