aws AWS Security Agent — Threat Model Review
Analyze spec documents (requirements.md, design.md) against the source code to identify security-posture changes using STRIDE methodology. No prior scan needed.
Local state
Read .security-agent/config.json for agent_space_id and region. If missing, run the setup-security-agent workflow inline first.
Resolving the values you need
| Placeholder | How to resolve |
|---|---|
<id> (agent space) |
config.agent_space_id |
<region> |
config.region (default us-east-1) |
<account> |
aws sts get-caller-identity --query Account --output text |
<role-arn> |
arn:aws:iam::<account>:role/SecurityAgentScanRole |
<bucket> |
security-agent-scans-<account>-<region> |
Workflow
Pre-checks. Read config, verify agent space, resolve values.
Collect spec files. Identify the
requirements.mdand/ordesign.mdthe user is working on. Use absolute paths. Ask if unclear which files to review.Zip the workspace (same exclusions as code scan):
cd <absolute-workspace-path> zip -r /tmp/source.zip . \ -x ".git/*" -x ".security-agent/*" -x "node_modules/*" \ -x "__pycache__/*" -x ".venv/*" -x "venv/*" \ -x "dist/*" -x "build/*" -x "target/*" \ -x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \ -x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc"Upload source zip:
SCAN_ID="tm-$(date +%s)-$(openssl rand -hex 3)" WORKSPACE_ID=$(printf '%s' "$(pwd)" | md5sum | cut -c1-12) aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zipUpload spec files:
aws s3 cp /path/to/requirements.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/requirements.md aws s3 cp /path/to/design.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/design.mdCreate threat model:
aws securityagent create-threat-model --agent-space-id <id> --title <title> \ --service-role <role-arn> \ --assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip}] \ --scope-docs '[{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/requirements.md"},{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/design.md"}]'Capture
threatModelId.Start threat model job:
aws securityagent start-threat-model-job --agent-space-id <id> --threat-model-id <tm-id>Capture
threatJobId.Persist to
scans.jsonwithscan_type: "THREAT_MODEL".Tell user: "Threat model review started. Runtime varies with workspace size. I'll check every 2 minutes — say 'stop polling' to opt out."
Poll every 2 minutes:
aws securityagent batch-get-threat-model-jobs --agent-space-id <id> --threat-model-job-ids <tj-id>Only respond when status changes.
On COMPLETED → fetch threats:
aws securityagent list-threats --agent-space-id <id> --threat-job-id <tj-id>If
nextToken, paginate with--next-token.
Findings presentation
Each threat includes: statement, severity, stride category, threatImpact, recommendation, impactedAssets.
🟣 CRITICAL: {statement}
STRIDE: {stride}
Impact: {threatImpact}
Assets: {impactedAssets}
Recommendation: {recommendation}
🔴 HIGH: {statement}
...
Write full report to .security-agent/findings-{scan_id}.md. Call out any threat that represents a regression from the prior design.
Rules
- Threat model reviews are standalone — no prior scan needed
- Poll every 2 minutes, not faster
- At least one spec file is required
- Use absolute paths for workspace and spec files
- Title:
threat-model-<feature-name>(no spaces)