# Security Review

> Review AI agent security — IAM policies, secret management, input validation, prompt injection defense, memory isolation. Use when the user asks about security, hardening, or threat modeling for agent systems.

- Skill: `aws-samples/security-review-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aws-samples/security-review-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aws-samples/security-review-2/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: aws-samples (https://skillmd.com/u/aws-samples)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/aws-samples/security-review-2

---


# Security Review

## IAM Best Practices for Agents
- Least-privilege execution roles: only the permissions the agent actually uses
- Separate roles for deploy-time vs runtime
- Use `execution_role_auto_create: false` + manual role for production
- Never pass `iam:*` or `bedrock:*` — scope to specific actions and resources
- Use ABAC (attribute-based access control) for multi-tenant isolation

## Secret Management
- Never store credentials in source code, configs, or SKILL.md files
- Use AWS Secrets Manager or SSM Parameter Store (SecureString)
- For AgentCore: use Identity service for OAuth token management
- Rotate secrets regularly; use short-lived credentials where possible

## Prompt Injection Defense
- Validate all user inputs before passing to agent
- Use GuardrailsHook for input/output validation
- Never let user input modify system prompts directly
- Use ToolPolicyHook to restrict which tools are available
- Log all tool invocations via AuditHook for forensics

## Memory Isolation
- Use server-side namespace isolation (`/actors/{actorId}/`)
- Never rely on client-side filtering for user separation
- S3 prefix isolation is NOT real isolation (same IAM role)
- AgentCore Memory namespace is API-level (server enforced)

## Agent-Specific Threats
- Tool abuse: agent calling destructive APIs without confirmation
- Memory poisoning: injecting false facts into LTM
- Session hijacking: using another user's session_id
- Exfiltration: agent leaking data through tool outputs