aws-audit-scanner
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AWS_PROFILE | No | The AWS profile to use for credentials. If not set, the ambient AWS credential chain (environment variables, instance role, etc.) is used. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_stopped_ec2B | Find stopped EC2 instances still incurring EBS costs. |
| scan_unattached_ebsA | Find EBS volumes not attached to any instance. |
| scan_s3_public_accessA | Find S3 buckets that are publicly accessible or missing guardrails. |
| scan_security_groupsB | Find security groups with dangerous ports open to the internet. |
| scan_iamA | Find IAM issues: root access keys, missing MFA, stale access keys. |
| scan_cloudtrailB | Check if CloudTrail logging is enabled and covering all regions. |
| sweep_other_regionsC | Presence-check every other enabled region for forgotten EC2/EBS/RDS resources. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a distinct AWS resource or audit concern (EC2, EBS, S3, security groups, IAM, CloudTrail, region sweep), with no overlapping purposes. The descriptions are specific enough to guide an agent to the correct tool without confusion.
All tools follow a consistent 'scan_<resource>' or 'sweep_<scope>' pattern, with scan_ used for the six core checks and sweep_ for cross-region discovery. This is a predictable and uniform convention that makes the tool set easy to navigate.
With 7 tools, the set is well-scoped for an AWS audit scanner, covering the major cost and security risk areas without overwhelming the user. Each tool corresponds to a distinct audit category, and the count is within the ideal range for a focused server.
The surface covers key AWS cost and security risks (stopped EC2, unattached EBS, S3 public access, security group exposure, IAM hygiene, CloudTrail coverage, and forgotten resources in other regions). Minor gaps include lack of checks for RDS snapshots or Lambda misconfigurations, but the core audit scope is well covered.