Threat Modeling With Aws Security Agent

AWS Security Agent — Threat Model Review

Analyze spec documents (requirements.md, design.md) against the source code to identify security-posture changes using STRIDE methodology. No prior scan needed.

Local state

Read .security-agent/config.json for agent_space_id and region. If missing, run the setup-security-agent workflow inline first.

Resolving the values you need

| Placeholder | How to resolve | |-------------|----------------| | ` (agent space) | config.agentspaceid | | | config.region (default us-east-1) | | | aws sts get-caller-identity --query Account --output text | | | arn:aws:iam:::role/SecurityAgentScanRole | | | security-agent-scans--` |

---

Workflow

1. Pre-checks. Read config, verify agent space, resolve values.

1. Collect spec files. Identify the requirements.md and/or design.md the user is working on. Use absolute paths. Ask if unclear which files to review.

1. Zip the workspace (same exclusions as code scan):

``bash cd zip -r /tmp/source.zip . \ -x ".git/*" -x ".security-agent/*" -x "node_modules/*" \ -x "__pycache__/*" -x ".venv/*" -x "venv/*" \ -x "dist/*" -x "build/*" -x "target/*" \ -x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \ -x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc" ``

1. Upload source zip:

``bash SCAN_ID="tm-$(date +%s)-$(openssl rand -hex 3)" WORKSPACE_ID=$(printf '%s' "$(pwd)" | md5sum | cut -c1-12) aws s3 cp /tmp/source.zip s3:///security-scans/source/${WORKSPACE_ID}/source.zip ``

1. Upload spec files:

``bash aws s3 cp /path/to/requirements.md s3:///security-scans/threat-models/${SCAN_ID}/specs/requirements.md aws s3 cp /path/to/design.md s3:///security-scans/threat-models/${SCAN_ID}/specs/design.md ``

1. Create threat model:

``bash aws securityagent create-threat-model --agent-space-id --title \ --service-role \ --assets sourceCode=[{s3Location=s3:///security-scans/source/${WORKSPACE_ID}/source.zip}] \ --scope-docs '[{"s3Location":"s3:///security-scans/threat-models/'${SCAN_ID}'/specs/requirements.md"},{"s3Location":"s3:///security-scans/threat-models/'${SCAN_ID}'/specs/design.md"}]' ``

Capture threatModelId.

1. Start threat model job:

``bash aws securityagent start-threat-model-job --agent-space-id --threat-model-id ``

Capture threatJobId.

1. Persist to scans.json with scan_type: "THREAT_MODEL".

1. Tell user: "Threat model review started. Runtime varies with workspace size. I'll check every 2 minutes — say 'stop polling' to opt out."

1. Poll every 2 minutes:

``bash aws securityagent batch-get-threat-model-jobs --agent-space-id --threat-model-job-ids ``

Only respond when status changes.

1. On COMPLETED → fetch threats:

``bash aws securityagent list-threats --agent-space-id --threat-job-id ``

If nextToken, paginate with --next-token.

Findings presentation

Each threat includes: statement, severity, stride category, threatImpact, recommendation, impactedAssets.

🟣 CRITICAL: {statement}
   STRIDE: {stride}
   Impact: {threatImpact}
   Assets: {impactedAssets}
   Recommendation: {recommendation}

🔴 HIGH: {statement}
   ...

Write full report to .security-agent/findings-{scan_id}.md. Call out any threat that represents a regression from the prior design.

---

Rules

• Threat model reviews are standalone — no prior scan needed
• Poll every 2 minutes, not faster
• At least one spec file is required
• Use absolute paths for workspace and spec files
• Title: threat-model- (no spaces)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: aws
• Source: aws/agent-toolkit-for-aws
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.