feat: add aiml-bedrock-security-assessment skill

cloudformation/devops-agent-skill-policies.yaml

@@ -28,6 +28,7 @@ Metadata:
           - EnableServiceQuotaCheck
           - EnableDmsOperationReview
           - EnableAgentCoreObservabilitySetup
+          - EnableAIMLBedrockSecurityAssessment
       - Label:
           default: Optional Resource Scoping
         Parameters:
@@ -118,6 +119,12 @@ Parameters:
     AllowedValues: ['true', 'false']
     Default: 'true'
 
+  EnableAIMLBedrockSecurityAssessment:
+    Type: String
+    Description: AI/ML Bedrock Security Assessment skill (adds read-only bedrock control-plane, cloudtrail, servicequotas, and inspector2 permissions; IAM/Organizations/EC2/CloudWatch/S3/KMS/Lambda reads are covered by AIDevOpsAgentAccessPolicy).
+    AllowedValues: ['true', 'false']
+    Default: 'true'
+
 Conditions:
   CreateNewRole: !Equals [!Ref ExistingRoleName, '']
   SkillAwsHealthEvents: !Equals [!Ref EnableAwsHealthEvents, 'true']
@@ -128,6 +135,7 @@ Conditions:
   SkillServiceQuotaCheck: !Equals [!Ref EnableServiceQuotaCheck, 'true']
   SkillDmsOperationReview: !Equals [!Ref EnableDmsOperationReview, 'true']
   SkillAgentCoreObservabilitySetup: !Equals [!Ref EnableAgentCoreObservabilitySetup, 'true']
+  SkillAIMLBedrockSecurityAssessment: !Equals [!Ref EnableAIMLBedrockSecurityAssessment, 'true']
   HasRegionRestriction: !Not [!Equals [!Join ['', !Ref AllowedRegions], '']]
 
 Resources:
@@ -348,6 +356,60 @@ Resources:
               - eks:DescribeCluster
             Resource: '*'
 
+  # aiml-bedrock-security-assessment: adds read-only Bedrock control-plane reads plus
+  # cloudtrail, servicequotas, and inspector2 reads not in the managed policy. IAM,
+  # Organizations, EC2, CloudWatch, S3, KMS, and Lambda reads are covered by
+  # AIDevOpsAgentAccessPolicy. Note: Bedrock Agents, Knowledge Bases, Flows, and Prompts
+  # use the `bedrock:` IAM prefix (the `bedrock-agent` name is only the SDK client).
+  # BR-14 (stale access) is prescribe-only and intentionally NOT granted, since it would
+  # require iam:GenerateServiceLastAccessedDetails (a Generate* verb blocked read-only).
+  PolicyAIMLBedrockSecurityAssessment:
+    Type: AWS::IAM::Policy
+    Condition: SkillAIMLBedrockSecurityAssessment
+    Properties:
+      PolicyName: DevOpsAgentSkill-AIMLBedrockSecurityAssessment
+      Roles:
+        - !If [CreateNewRole, !Ref DevOpsAgentRole, !Ref ExistingRoleName]
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: BedrockControlPlaneRead
+            Effect: Allow
+            Action:
+              - bedrock:GetAgent
+              - bedrock:GetAgentActionGroup
+              - bedrock:GetCustomModel
+              - bedrock:GetFlow
+              - bedrock:GetGuardrail
+              - bedrock:GetImportedModel
+              - bedrock:GetKnowledgeBase
+              - bedrock:GetModelCustomizationJob
+              - bedrock:GetModelInvocationLoggingConfiguration
+              - bedrock:GetPrompt
+              - bedrock:ListAgentActionGroups
+              - bedrock:ListAgents
+              - bedrock:ListCustomModels
+              - bedrock:ListEvaluationJobs
+              - bedrock:ListFlows
+              - bedrock:ListFoundationModels
+              - bedrock:ListGuardrails
+              - bedrock:ListImportedModels
+              - bedrock:ListKnowledgeBases
+              - bedrock:ListModelInvocationJobs
+              - bedrock:ListPrompts
+            Resource: '*'
+          - Sid: BedrockAuditAndAbuseControlsRead
+            Effect: Allow
+            Action:
+              - cloudtrail:GetEventSelectors
+              - cloudtrail:GetTrail
+              - cloudtrail:GetTrailStatus
+              - cloudtrail:ListTrails
+              - servicequotas:GetAWSDefaultServiceQuota
+              - servicequotas:GetServiceQuota
+              - inspector2:BatchGetAccountStatus
+            Resource: '*'
+
   # Optional: restrict agent to specific regions
   PolicyRegionalRestriction:
     Type: AWS::IAM::Policy
@@ -396,7 +458,9 @@ Outputs:
         - service-quota-check: ${EnableServiceQuotaCheck} (servicequotas:*, cloudwatch:GetMetricData/GetMetricStatistics)
         - database-migration-service-expertise: ${EnableDmsOperationReview} (dms:TestConnection)
         - agentcore-observability-setup: ${EnableAgentCoreObservabilitySetup} (bedrock-agentcore:Get/ListAgentRuntime, xray:GetTraceSegmentDestination, logs:DescribeDeliveries/DeliverySources/DeliveryDestinations/ResourcePolicies, lambda:GetFunctionConfiguration, ecs:DescribeTaskDefinition/DescribeServices/ListTasks, eks:DescribeCluster)
+        - aiml-bedrock-security-assessment: ${EnableAIMLBedrockSecurityAssessment} (bedrock:Get*/List* control-plane reads, cloudtrail:Get*/ListTrails, servicequotas:GetServiceQuota/GetAWSDefaultServiceQuota, inspector2:BatchGetAccountStatus)
       Skills covered by AIDevOpsAgentAccessPolicy (no extra policy needed):
         - eks-operation-review, enrich-with-aws-security-agent, crm-production-investigation-guidelines
+        - aiml-bedrock-security-assessment relies on it for IAM/Organizations/EC2/CloudWatch/S3/KMS/Lambda reads (only the Bedrock/cloudtrail/servicequotas/inspector2 delta is added above)
       No IAM required:
         - skip-scheduled-maintenance

llms.txt

@@ -32,6 +32,7 @@ Skills can be used with these AWS DevOps Agent types:
 - [Analytics OpenSearch Expertise Skill](skills/analytics-opensearch-expertise/SKILL.md): Performs read-only health assessments of Amazon OpenSearch Service domains through 24 deterministic checks across cluster health, storage and shards, performance, security, and cost optimization, producing a structured findings report with prioritized remediation guidance
 - [AI/ML Access Diagnostics Skill](skills/aiml-access-diagnostics/SKILL.md): Diagnoses IAM and access failures for Amazon Bedrock and SageMaker calls by tracing the authorization chain from caller identity through iam:PassRole, role trust policy, role permissions, resource policies, and SCPs to identify which hop denied the call
 - [AgentCore Observability Setup Skill](skills/agentcore-observability-setup/SKILL.md): Validates and bootstraps Amazon Bedrock AgentCore observability across runtime agents, Memory and Gateway resources, built-in tools, and agents hosted outside the runtime, verifying telemetry wiring via read-only CloudWatch, X-Ray, and AgentCore APIs and prescribing exact remediation for gaps it cannot directly read
+- [Amazon Bedrock Security Assessment Skill](skills/aiml-bedrock-security-assessment/SKILL.md): Runs a read-only Amazon Bedrock security posture assessment across an account, regions, and associated accounts through 33 deterministic checks (guardrail coverage, KMS encryption, VPC endpoints, agent and action-group IAM least privilege, model-invocation logging, CloudTrail, CloudWatch alarms, throttling, and Inspector scanning), classifying each check as verifiable, heuristic, or prescribe-only so unread controls are never marked passing
 
 ## Key Concepts
 

skills/aiml-bedrock-security-assessment/.skilleval.yaml

@@ -0,0 +1,3 @@
+audit:
+  ignore:
+    - STR-016  # README alongside SKILL.md is intentional

skills/aiml-bedrock-security-assessment/CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to the `aiml-bedrock-security-assessment` skill are documented
+here. This project adheres to [Semantic Versioning](https://semver.org/).
+
+## [1.0.0] - 2026-09-09
+
+### Added
+- Initial release. Read-only Amazon Bedrock security posture assessment as an AWS
+  DevOps Agent skill — the Bedrock domain of a per-domain AI/ML security posture
+  family.
+- **33 read-only Bedrock checks (`BR-01`..`BR-33`)** covering guardrail coverage
+  (content filters, sensitive-information, contextual grounding, automated
+  reasoning, tiers), KMS encryption (custom/imported models, knowledge bases,
+  invocation logs, batch output), VPC private connectivity, agent and
+  action-group IAM least privilege, agent guardrail association and idle-session
+  TTL, CloudTrail coverage, CloudWatch alarms, service-quota throttling, and
+  Inspector Lambda scanning.
+- **Verify-vs-prescribe determinism contract:** each check is classified
+  `Verifiable` (22), `Heuristic` (10), or `Prescribe-only` (1). The report never
+  marks an unread or access-denied control as `Passed`; `BR-14` (stale access) is
+  always `N/A` under the DevOps Agent read-only guardrail.
+- **Owns-vs-defers boundaries** against `bedrock-adoption-readiness`,
+  `aiml-access-diagnostics`, and `agentcore-observability-setup`.
+- Orchestrator `SKILL.md`, per-check catalog
+  (`references/bedrock-checks.md`), and finding schema + report format
+  (`references/finding-schema-and-report.md`).
+- Multi-region and multi-account support via AWS DevOps Agent account
+  associations (findings carry an `Account` field; global IAM/Org checks emitted
+  once per account; the skill never assumes roles itself).
+
+### Notes
+- Scope is intentionally Amazon Bedrock only. SageMaker, AgentCore, Agentic-AI,
+  Responsible AI GRC, and OWASP Top 10 for LLM are separate skills, not phases of
+  this one.

skills/aiml-bedrock-security-assessment/README.md

@@ -0,0 +1,115 @@
+# Amazon Bedrock Security Assessment — AWS DevOps Agent Skill
+
+An AWS DevOps Agent skill that runs a **read-only** Amazon Bedrock security posture
+assessment across an AWS account and regions (and, optionally, across associated
+accounts). It covers **33 Bedrock checks (`BR-01`..`BR-33`)** spanning guardrail
+coverage, KMS encryption, VPC private connectivity, agent/action-group IAM,
+logging, alarms, throttling, and Inspector scanning, and produces a consolidated,
+severity-rated findings report.
+
+The DevOps Agent runs the read-only checks directly using its AWS API access, then
+assembles the report. No infrastructure is deployed in the account.
+
+> ⚠️ This skill is sample code, not intended for production use without additional
+> review and testing. Validate in a non-production environment first.
+
+## Scope: what it owns vs. defers
+
+This is the **Bedrock domain** of a per-domain family of AI/ML security posture
+skills. It deliberately draws boundaries against the other AI/ML skills in this
+repository:
+
+- **Owns** — proactive, point-in-time **security misconfiguration posture** of
+  Bedrock control-plane resources (guardrails, encryption, network, agent IAM,
+  logging presence, abuse controls).
+- **Defers to
+  [`bedrock-adoption-readiness`](https://github.com/aws/tools-for-devops-agent/blob/main/skills/bedrock-adoption-readiness/SKILL.md)**
+  — Bedrock production-adoption readiness (ZDR/data-retention, quota/capacity
+  headroom, observability maturity, bedrock-mantle surface).
+- **Defers to
+  [`aiml-access-diagnostics`](https://github.com/aws/tools-for-devops-agent/blob/main/skills/aiml-access-diagnostics/SKILL.md)**
+  — reactive diagnosis of *why a specific Bedrock call was denied* (authorization
+  chain tracing). This skill reports static IAM posture only, never a specific
+  denial.
+- **Out of scope** — Amazon SageMaker, Amazon Bedrock AgentCore (AgentCore
+  observability is owned by
+  [`agentcore-observability-setup`](https://github.com/aws/tools-for-devops-agent/blob/main/skills/agentcore-observability-setup/SKILL.md)),
+  Responsible AI GRC, and OWASP Top 10 for LLM — each a separate skill.
+
+## Verify vs. prescribe
+
+Every check is classified so the report never marks an unread control as
+`Passed`:
+
+- **Verifiable (22 checks)** — a read-only call returns the exact config;
+  deterministic verdict.
+- **Heuristic (10 checks)** — readable but inferred (e.g. IAM least-privilege);
+  the verdict cites concrete evidence, and ambiguous/denied reads become `N/A`,
+  not `Passed`.
+- **Prescribe-only (1 check — `BR-14` stale access)** — requires
+  `iam:GenerateServiceLastAccessedDetails`, a `Generate*` verb the DevOps Agent
+  read-only guardrail blocks; always reported `N/A` with out-of-band remediation,
+  never `Passed`/`Failed`.
+
+See
+[`references/bedrock-checks.md`](https://github.com/aws/tools-for-devops-agent/blob/main/skills/aiml-bedrock-security-assessment/references/bedrock-checks.md)
+for the per-check classification and
+[`references/finding-schema-and-report.md`](https://github.com/aws/tools-for-devops-agent/blob/main/skills/aiml-bedrock-security-assessment/references/finding-schema-and-report.md)
+for the output contract.
+
+## Read-only guarantee
+
+Every check is read-only (`Describe*`/`List*`/`Get*`/`BatchGet*`). The skill never
+creates, modifies, deletes, attaches, enables, or disables any resource, and never
+calls non-read verbs (including analysis verbs like
+`iam:GenerateServiceLastAccessedDetails`). Remediation is reported as guidance
+only.
+
+## Prerequisites
+
+- An AWS DevOps Agent **Agent Space** with this skill imported.
+- The agent's execution role needs read-only access to the assessed services. The
+  baseline **`AIDevOpsAgentAccessPolicy`** covers most reads; the Bedrock-specific
+  reads beyond that baseline (e.g. `bedrock:Get*`/`List*`, `bedrock-agent:*` reads,
+  `cloudtrail:Get*`, `servicequotas:Get*`, `inspector2:BatchGetAccountStatus`) are
+  delivered as a **gated read-only inline policy**
+  (`EnableAIMLBedrockSecurityAssessment`, default `true`) in the repository's
+  `cloudformation/devops-agent-skill-policies.yaml`. Checks whose reads are not
+  granted return `N/A (AccessDenied)`.
+- **(Multi-account, optional)** Associate each additional account with the Agent
+  Space as a secondary source with a monitoring role carrying
+  `AIDevOpsAgentAccessPolicy` plus the gated add-on. The DevOps Agent service
+  assumes that read-only role directly; the skill does not assume roles itself.
+
+## Usage
+
+Invoke the agent conversationally, e.g.:
+
+- "Run the Amazon Bedrock security assessment in `us-east-1` (read-only)."
+- "Audit our Bedrock guardrails and model-invocation logging across `us-east-1`
+  and `us-west-2`."
+- "Assess Bedrock security across all associated accounts and give me a
+  per-account breakdown."
+
+## Importing the skill
+
+Zip the `aiml-bedrock-security-assessment/` directory (must contain `SKILL.md`
+with frontmatter) and upload via the Operator Web App (Knowledge → Skills → Add
+skill), or import from the GitHub directory. ZIP only, ≤ 6 MB, ≤ 100 files, no
+`scripts/` directory.
+
+## Limitations
+
+- **Point-in-time:** results reflect configuration at scan time; re-run regularly.
+- **No guarantee of security/compliance:** identifies common misconfigurations
+  against AWS best practices; does not replace formal audits.
+- **Shared Responsibility Model:** assesses customer-configurable controls, not
+  AWS-managed infrastructure.
+- **Coverage:** Amazon Bedrock only.
+
+## Provenance
+
+Bedrock check definitions, severities, API calls, and reference URLs derive from
+the open-source
+[AWS AI/ML Security Assessment](https://github.com/aws-samples/sample-aiml-security-assessment)
+framework (`docs/SECURITY_CHECKS*.md`), licensed MIT-0 upstream.