AI agents for AWS
The infrastructure bill and the services behind it. AGNT connects to AWS so agents can read what happens there, reason about it, and act — with a receipt for every run.
AWS and AGNT, in brief
| What it does | Lets an AGNT agent read from and act in AWS. |
|---|---|
| Connects with | SigV4 — held in the local vault |
| AGNT node | custom-api, or the zapier-action bridge |
| Runs when | A scheduled audit runs |
| Typical build time | Ten minutes |
| Where data goes | Nowhere by default — AGNT runs on your machine and credentials never leave it. |
What you can automate
Reacts when…
- a scheduled audit runs
- a cost threshold trips
Agents can…
- query service state
- produce cost summaries
- file findings
Teams use it for
- cost anomalies explained weekly
- resource audits on schedule
- infra changes summarised for review
The AWS workflow, to configure
Design goal for AWS: cost anomalies explained weekly; resource audits on schedule; infra changes summarised for review. The template below supplies configurable nodes, not the complete logic for those goals.
Use this AWS setup template to arrange the schedule, input review and API operation. Configure the account-specific fields and add your own decision and approval controls before activation.
This is a schema-checked starting point, not an end-to-end tested automation. Replace every CONFIGURE_ value, choose the operations you intend, connect credentials and map source outputs into later inputs. An edge orders steps; it does not supply a condition, an approval gate or a field mapping. Add and test those controls explicitly before any write. Cloud APIs and model providers may receive data. Keep the workflow inactive until tested with fixtures.
{
"id": "ce704c48-563c-4d91-abb1-cd29db1ba41e",
"name": "AWS — read, decide, act",
"nodes": [
{
"id": "f0686deb-28f5-4a4e-aa68-25892cb14ecc",
"text": "Run on a schedule",
"x": 512,
"y": 144,
"isEditing": false,
"type": "trigger-timer",
"icon": "clock",
"category": "trigger",
"isSelected": false,
"parameters": {
"fireOnStart": "No",
"scheduleType": "Interval",
"schedule": "Every 15 Minutes"
},
"description": "Setup template for Timer Trigger. This trigger node fires the workflow at specified intervals or at a specific time. Configure credentials, inputs and output mapping before use.",
"error": null,
"isActive": false,
"output": null,
"outputs": {}
},
{
"id": "66fba049-7975-411d-a788-1d9686c6be6a",
"text": "Review source and draft",
"x": 512,
"y": 336,
"isEditing": false,
"type": "agnt-agent",
"icon": "agnt",
"category": "action",
"isSelected": false,
"parameters": {
"agentId": "CONFIGURE_AGENTID",
"message": "Decide what needs to happen in AWS. Explain your reasoning.\nSource input: CONFIGURE_SOURCE_INPUT. Produce a reviewable draft only; do not take external actions."
},
"description": "Setup template for Agent Chat. Chat with an AI agent from your agent library. Select an agent and send messages to interact with it within your workflow. Configure credentials, inputs and output mapping before use.",
"error": null,
"isActive": false,
"output": null,
"outputs": {}
},
{
"id": "11e53958-ba06-4fd6-a163-17905a609ffc",
"text": "Call the AWS API",
"x": 512,
"y": 528,
"isEditing": false,
"type": "custom-api",
"icon": "connect",
"category": "action",
"isSelected": false,
"parameters": {
"url": "https://{service}.{region}.amazonaws.com/",
"method": "GET",
"authType": "None",
"headers": "{}",
"query": ""
},
"description": "Setup template for Custom API Request. This action node makes a custom API request to any endpoint with configurable method, headers, and authentication. Configure credentials, inputs and output mapping before use.",
"error": null,
"isActive": false,
"output": null,
"outputs": {}
}
],
"edges": [
{
"id": "df951030-e2e8-4d29-a6ae-e10195b182ba",
"start": {
"id": "f0686deb-28f5-4a4e-aa68-25892cb14ecc",
"type": "output"
},
"end": {
"id": "66fba049-7975-411d-a788-1d9686c6be6a",
"type": "input"
},
"startX": 800,
"startY": 168,
"endX": 512,
"endY": 360
},
{
"id": "68849d16-6ed1-455a-a4a2-1552603fffb0",
"start": {
"id": "66fba049-7975-411d-a788-1d9686c6be6a",
"type": "output"
},
"end": {
"id": "11e53958-ba06-4fd6-a163-17905a609ffc",
"type": "input"
},
"startX": 800,
"startY": 360,
"endX": 512,
"endY": 552
}
],
"zoomLevel": 1,
"canvasOffsetX": 0,
"canvasOffsetY": 0,
"isTinyNodeMode": false
}Configure Custom API Request
This action node makes a custom API request to any endpoint with configurable method, headers, and authentication.
- url — The URL of the API endpoint Current example:
https://{service}.{region}.amazonaws.com/. - method — The HTTP method for the request Current example:
GET. - authType — The type of authentication Current example:
None. - query — Query parameters for the request (e.g., 'key1=value1&key2=value2') Current example:
. - headers — Optional headers for the request. e.g., {"Content-Type": "application/json"} Current example:
{}.
Try the AWS flow yourself
No account needed to run it. Every step writes a receipt you can read line by line afterwards.
The bill nobody can explain
Cloud spend rises quietly and gets investigated late. A scheduled audit that reports what changed and offers an explanation turns a monthly surprise into a weekly note, which is the difference between noticing and reacting.
Read first, act rarely
Infrastructure automation deserves conservative boundaries. Querying state, summarising cost and filing findings is high value and low risk; anything that changes infrastructure belongs behind an explicit approval gate.
Connecting AWS today
Reaching AWS means one custom-api node rather than a purpose-built one. The endpoint and its sigv4 credentials are all it needs, and the zapier-action bridge covers it too if you would rather not hand-roll the request.
| What you need | Value |
|---|---|
| Endpoint | https://{service}.{region}.amazonaws.com/ |
| Method | POST |
| Authentication | SigV4 |
| Header | Authorization: AWS4-HMAC-SHA256 Credential={key}/... |
| Reference | AWS API documentation |
Worth knowing: SigV4 signs the request body, so the signature must be computed after the payload is final — use an execute-javascript node ahead of the request rather than a static header.
The part that catches people out
SigV4 signs the request body, so the signature must be computed after the payload is final — use an execute-javascript node ahead of the request rather than a static header.
It is worth getting right first, because the failure is quiet rather than loud — you get a response, it just is not the one you wanted. Once past it, AWS is a straightforward API to automate against.
Connect AWS in two minutes
- Download AGNT Community Core — free, local-first, no account needed to run.
- Connect by pasting an API key into AGNT’s vault — stored encrypted on your machine, never uploaded.
- Drop the AWS node into a workflow or hand it to an agent — the first run produces a receipt you can read line by line.
AWS + AGNT — common questions
Can it explain a cost spike?
It can query service state and correlate the change with what else happened, which is usually enough to name the cause.
Should agents change infrastructure?
Reading and reporting first. Anything mutating belongs behind an approval gate.
How is AWS connected?
With scoped API credentials held encrypted in the local vault.
