AWS Agents For Devsecops

Skill 13 of 130

Threat Modeling With AWS Security Agent

Run an AWS Security Agent threat model review on spec/design documents.

1 minute · 212 words · 6 sections

Install

$ npx skills add aws/agent-toolkit-for-aws --skill threat-modeling-with-aws-security-agent

$ npx skills add aws/agent-toolkit-for-aws

» /plugin marketplace add aws/agent-toolkit-for-aws

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

AWS Security Agent — Threat Model Review

Analyze spec documents (requirements.md, design.md) against the source code to identify security-posture changes using STRIDE methodology. No prior scan needed.

Local state

Read .security-agent/config.json for agent_space_id and region. If missing, run the setup-security-agent workflow inline first.

Resolving the values you need

Placeholder	How to resolve
`<id>` (agent space)	`config.agent_space_id`
`<region>`	`config.region` (default `us-east-1`)
`<account>`	`aws sts get-caller-identity --query Account --output text`
`<role-arn>`	`arn:aws:iam::<account>:role/SecurityAgentScanRole`
`<bucket>`	`security-agent-scans-<account>-<region>`

Workflow

Pre-checks. Read config, verify agent space, resolve values.
Collect spec files. Identify the requirements.md and/or design.md the user is working on. Use absolute paths. Ask if unclear which files to review.

Zip the workspace (same exclusions as code scan):

cd <absolute-workspace-path>
zip -r /tmp/source.zip . \
  -x ".git/*" -x ".security-agent/*" -x "node_modules/*" \
  -x "__pycache__/*" -x ".venv/*" -x "venv/*" \
  -x "dist/*" -x "build/*" -x "target/*" \
  -x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \
  -x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc"

Upload source zip:

SCAN_ID="tm-$(date +%s)-$(openssl rand -hex 3)"
WORKSPACE_ID=$(printf '%s' "$(pwd)" | md5sum | cut -c1-12)
aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip --expected-bucket-owner <account>

Upload spec files:

aws s3 cp /path/to/requirements.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/requirements.md --expected-bucket-owner <account>
aws s3 cp /path/to/design.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/design.md --expected-bucket-owner <account>

Create threat model:

aws securityagent create-threat-model --agent-space-id <id> --title <title> \
  --service-role <role-arn> \
  --assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip}] \
  --scope-docs '[{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/requirements.md"},{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/design.md"}]'

Capture threatModelId.

Start threat model job:

aws securityagent start-threat-model-job --agent-space-id <id> --threat-model-id <tm-id>

Capture threatJobId.

Persist to scans.json with scan_type: "THREAT_MODEL".
Tell user: “Threat model review started. Runtime varies with workspace size. I’ll check every 2 minutes — say ‘stop polling’ to opt out.”

Poll every 2 minutes:

aws securityagent batch-get-threat-model-jobs --agent-space-id <id> --threat-model-job-ids <tj-id>

Only respond when status changes.

On COMPLETED → fetch threats:

aws securityagent list-threats --agent-space-id <id> --threat-job-id <tj-id>

If nextToken, paginate with --next-token.

Findings presentation

Each threat includes: statement, severity, stride category, threatImpact, recommendation, impactedAssets.

🟣 CRITICAL: {statement}
   STRIDE: {stride}
   Impact: {threatImpact}
   Assets: {impactedAssets}
   Recommendation: {recommendation}

🔴 HIGH: {statement}
   ...

Write full report to .security-agent/findings-{scan_id}.md. Call out any threat that represents a regression from the prior design.

Rules

Threat model reviews are standalone — no prior scan needed
Poll every 2 minutes, not faster
At least one spec file is required
Use absolute paths for workspace and spec files
Title: threat-model-<feature-name> (no spaces)

About this skill

Trigger

Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Colophon for this issue

Colophon

How this issue was made

Source

github.com/aws/agent-toolkit-for-aws, branch main, last pushed 24 September 2026.

Licence

Apache-2.0 — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

130 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. 19 distinct layouts observed: plugins/aws-agents-for-devsecops/skills/*/SKILL.md, plugins/aws-agents/skills/*/SKILL.md, plugins/aws-core/skills/*/SKILL.md, skills/core-skills/*/SKILL.md, skills/specialized-skills/analytics-skills/*/SKILL.md, skills/specialized-skills/database-skills/*/SKILL.md, skills/specialized-skills/ec2-skills/*/SKILL.md, skills/specialized-skills/end-user-computing-skills/*/SKILL.md, skills/specialized-skills/messaging-and-streaming-skills/*/SKILL.md, skills/specialized-skills/migration-and-modernization-skills/*/SKILL.md, skills/specialized-skills/networking-and-content-delivery-skills/*/SKILL.md, skills/specialized-skills/operations-skills/*/SKILL.md, skills/specialized-skills/quantum-computing-skills/*/SKILL.md, skills/specialized-skills/resilience-skills/*/SKILL.md, skills/specialized-skills/security-and-identity-skills/*/SKILL.md, skills/specialized-skills/serverless-skills/*/SKILL.md, skills/specialized-skills/storage-skills/*/SKILL.md, skills/specialized-skills/system-table-skills/*/SKILL.md, skills/specialized-skills/web-and-mobile-development/*/SKILL.md.

Duplicates collapsed

34 mirror copies folded into their canonical skill — republished for Alternate. Copies match on content hash and on position once a leading per-agent prefix is stripped, because the same skill is routinely shipped under a dozen agent directories with a dozen different hashes.

Issue colours

Resolved from a curated brand profile — hue 65°, chroma 0.174. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Shifted “6 headings” from h1 to h2 so the skill title is the only h1.

Spec compliance

Every skill satisfies the Agent Skills specification’s frontmatter rules.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .claude-plugin/marketplace.json by Amazon Web Services, declaring 4 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /aws/agent-toolkit-for-aws.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

AWS Security Agent — Threat Model Review

Analyze spec documents (requirements.md, design.md) against the source code to identify security-posture changes using STRIDE methodology. No prior scan needed.

Local state

Read .security-agent/config.json for agent_space_id and region. If missing, run the setup-security-agent workflow inline first.

Resolving the values you need

Placeholder	How to resolve
`<id>` (agent space)	`config.agent_space_id`
`<region>`	`config.region` (default `us-east-1`)
`<account>`	`aws sts get-caller-identity --query Account --output text`
`<role-arn>`	`arn:aws:iam::<account>:role/SecurityAgentScanRole`
`<bucket>`	`security-agent-scans-<account>-<region>`

Workflow

Pre-checks. Read config, verify agent space, resolve values.
Collect spec files. Identify the requirements.md and/or design.md the user is working on. Use absolute paths. Ask if unclear which files to review.

Zip the workspace (same exclusions as code scan):

cd <absolute-workspace-path>
zip -r /tmp/source.zip . \
  -x ".git/*" -x ".security-agent/*" -x "node_modules/*" \
  -x "__pycache__/*" -x ".venv/*" -x "venv/*" \
  -x "dist/*" -x "build/*" -x "target/*" \
  -x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \
  -x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc"

Upload source zip:

SCAN_ID="tm-$(date +%s)-$(openssl rand -hex 3)"
WORKSPACE_ID=$(printf '%s' "$(pwd)" | md5sum | cut -c1-12)
aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip --expected-bucket-owner <account>

Upload spec files:

aws s3 cp /path/to/requirements.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/requirements.md --expected-bucket-owner <account>
aws s3 cp /path/to/design.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/design.md --expected-bucket-owner <account>

Create threat model:

aws securityagent create-threat-model --agent-space-id <id> --title <title> \
  --service-role <role-arn> \
  --assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip}] \
  --scope-docs '[{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/requirements.md"},{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/design.md"}]'

Capture threatModelId.

Start threat model job:

aws securityagent start-threat-model-job --agent-space-id <id> --threat-model-id <tm-id>

Capture threatJobId.

Persist to scans.json with scan_type: "THREAT_MODEL".
Tell user: “Threat model review started. Runtime varies with workspace size. I’ll check every 2 minutes — say ‘stop polling’ to opt out.”

Poll every 2 minutes:

aws securityagent batch-get-threat-model-jobs --agent-space-id <id> --threat-model-job-ids <tj-id>

Only respond when status changes.

On COMPLETED → fetch threats:

aws securityagent list-threats --agent-space-id <id> --threat-job-id <tj-id>

If nextToken, paginate with --next-token.

Findings presentation

Each threat includes: statement, severity, stride category, threatImpact, recommendation, impactedAssets.

🟣 CRITICAL: {statement}
   STRIDE: {stride}
   Impact: {threatImpact}
   Assets: {impactedAssets}
   Recommendation: {recommendation}

🔴 HIGH: {statement}
   ...

Write full report to .security-agent/findings-{scan_id}.md. Call out any threat that represents a regression from the prior design.

Rules

Threat model reviews are standalone — no prior scan needed
Poll every 2 minutes, not faster
At least one spec file is required
Use absolute paths for workspace and spec files
Title: threat-model-<feature-name> (no spaces)