> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/agents/onboarding-agents/discovering-agents-from-integrations/aws-agents.md).

# AWS: Agents

### Overview

BalkanID supports discovery and governance of agents within Amazon Web Services (AWS), including **Bedrock Agents Classic** and **AgentCore harnesses**, as part of **IGA for Non-Human Identities (NHI)**.

{% hint style="info" %}
**Early Access:** Agents discovery is an Early Access capability. To enable Agents (Early Access) for your tenant, contact Customer Support. AWS agent discovery also requires read-only Bedrock agent permissions on the integration IAM role or user, in addition to your existing AWS integration credentials.
{% endhint %}

All agents are normalized into the BalkanID data model and surfaced on the **Agents** page under **Configure**, along with their owners, associated identities, access relationships, and risk insights.

The associated agents can also be seen under the specific application integration (Amazon Web Services) page.

### Required AWS configuration for Agent Discovery

To enable AWS agent discovery, your BalkanID AWS integration IAM role or user must allow read-only Bedrock agent APIs in the sync region. See [Bedrock agent read permissions](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integrations/aws-application-integration-setup.md#bedrock-agent-read-permissions) in the [AWS Application Integration Setup](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integrations/aws-application-integration-setup.md) page.

`IAMReadOnlyAccess` alone does not include Bedrock agent inventory APIs. Attach the supplemental inline policy documented on the setup page, or an equivalent custom policy that grants the required actions.

Agents discovery must be enabled for your tenant (Early Access). After sync, extracted agents appear on **Configure → Agents** and on the AWS application **Agents** tab.

### Agent Types Supported

BalkanID tracks the following AWS agent types:

{% hint style="info" %}
Note: The agent types listed below are examples and do not represent the full set of supported AWS agents over time.
{% endhint %}

* **Bedrock Classic agents** — Agents created with the Bedrock Agents Classic API
* **AgentCore harnesses** — AgentCore harness resources in your AWS account

### What BalkanID discovers for AWS agents

For AWS Bedrock and AgentCore agents, BalkanID can surface:

* **Agent inventory** — Bedrock Classic agents and AgentCore harnesses in the integrated AWS account and region, including status (for example, prepared or failed)
* **Agent metadata** — Name, ARN, foundation model or model ID, description (Bedrock Classic), and session settings where available
* **Execution IAM role** — The IAM role the agent uses at runtime, linked through a **uses** access relationship
* **Account and region context** — AWS account ID and region for each discovered agent

For concepts, see [Introduction to Agents](/agents/introduction-to-agents.md). For the Agents UI after sync, see [Viewing Agents](/agents/viewing-agents.md).

### Common risks associated with AWS Agents include:

* **Unowned Automation:** Bedrock or AgentCore agents synced into BalkanID without an assigned employee owner, reducing accountability.
* **Over-Privileged Execution Roles:** Agents whose execution IAM roles grant broad or administrative access across the AWS account.
* **Stale or Failed Agents:** Agents left in a failed or unprepared state that may still hold configured permissions or role trust relationships.
* **Cross-Service Blast Radius:** Execution roles shared across multiple agents or workloads, increasing impact if one agent is compromised.

This ensures visibility and governance of AI agent access in AWS, forming a critical part of IGA for Non-Human Identities.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.balkan.id/agents/onboarding-agents/discovering-agents-from-integrations/aws-agents.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.