AWS Scanner

The AWS Scanner is a native scanner type that inspects a connected AWS account, discovering the full inventory of identities, including human and non-human identities such as IAM users, roles, and groups, and AI agents built on Amazon Bedrock Agents and Amazon Bedrock AgentCore, along with secrets stored in AWS Secrets Manager and certificates managed through AWS Certificate Manager, as well as the relationships between them. Each discovered object is evaluated against Identity & Secrets Intelligence security policies, which assess its risk posture and surface the resulting findings for review.

What the AWS Scanner Discovers

Each scanner covers one or more object types, selected when the scanner is created:

Secrets, certificates, secret usage, and AI agents are discovered in the region configured on the AWS Target. IAM identities are global, so they are discovered for the whole account. To cover several regions, create an AWS Target and a scanner for each region.

Prerequisites

• An Akeyless account with the Identity & Secrets Intelligence license.
• A deployed and connected Akeyless Gateway version 4.53.0 and later. Scanning AI agents requires version 5.5.0 and later.
• A Gateway with Akeyless AI Insights configured.
• An AWS Target representing the AWS IAM Role that will scan the account.
• The AWS IAM Role used by the Target granted the permissions listed under AWS Service Account Permissions below.
• Access to configure and run the scanner, granted via:
  • Manage ISI Scanners or Admin Gateway Permission.
  • Identity & Secrets Intelligence Administrative Rule set to Scoped or All.
  • List permission on the GitLab Target.

Required AWS Permissions

The AWS IAM Role used by the Target needs read access to the AWS services behind each object type selected on the scanner. Every table in this section has an Object Type column, so you can grant only what the selected object types need.

There are two ways to grant the permissions:

• Quick Setup - attach broad AWS managed policies. Fastest to configure, but grants more access than the scanner actually uses.
• Granular Permissions - attach only the exact actions the scanner needs, following the principle of least privilege.

Both produce a complete scan. The difference is privilege scope, not scan coverage.

Quick Setup

For each object type selected on the scanner, attach the AWS managed policies and the custom policy statement listed below:

The custom policy below covers the services that have no read-only AWS managed policy: AWS Secrets Manager, Amazon Bedrock AgentCore, and AWS KMS. Keep the statement for each object type you selected, and remove the other:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SecretsReadOnly",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:ListSecrets",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds",
        "secretsmanager:GetResourcePolicy"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AIAgentsReadOnly",
      "Effect": "Allow",
      "Action": [
        "bedrock-agentcore:ListAgentRuntimes",
        "bedrock-agentcore:GetAgentRuntime",
        "bedrock-agentcore:ListGateways",
        "bedrock-agentcore:ListGatewayTargets",
        "kms:DescribeKey",
        "kms:GetKeyRotationStatus"
      ],
      "Resource": "*"
    }
  ]
}

"Resource": "*" above gives full coverage but can be scoped down. Anything out of scope is reported as a gap in the scan details.

Granular Permissions

All permissions below are read-only. The scanner never requires write access to your AWS environment, and never reads the values of secrets stored in AWS Secrets Manager, only their metadata.

Required Permissions

The permissions listed below are required for the scan to complete successfully. If one is missing for an object type selected on the scanner, the scan fails, in the cases described below:

A failure in any selected object type marks the whole scan as failed.

Additional Permissions for Complete Coverage

These permissions are optional. If missing, the scan still completes, but with reduced visibility, and the policies that depend on them are not evaluated.

Each gap entry names the skipped resource, the missing permissions, and the AWS managed policy or custom policy that grants them.

Create an AWS Scanner in the Akeyless Console

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click New, and select the scanner type AWS, then click Next.
3. Define a Name for the scanner.
4. Select the Target representing the AWS account to scans, and the Gateway that will execute the scans, then click Next.
5. Use the Object Type drop-down list to select the scanner's scope, and click Finish.

Run a Scan

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click the AWS scanner.
3. Click Start Scan.

Once the scan completes, results appear in Inventory for review.