The AWS audit as one list, with an owner on every row

What policy should the connected identity carry?

A narrow one, written for the job you have.

If the point is reading CloudWatch metrics and listing S3 objects in one bucket, write exactly that: two services, named resources, one region, and a Deny on everything else if your organisation uses permission boundaries. A managed policy with `FullAccess` in the name is how this goes wrong.

IAM also gives you conditions. Restrict by region so a stray call cannot create resources somewhere nobody monitors. Start read-only and add a single write permission when a named workflow needs it. This is ordinary least-privilege practice and it applies to an agent exactly as it applies to a CI runner.

• A dedicated IAM user or assumed role, never a root credential and never a shared one.
• Service-scoped and resource-scoped statements, not a managed FullAccess policy.
• A region condition, so nothing can appear in an account corner nobody watches.
• Read-only as the starting point, with individual writes added deliberately.

What can a companion do with AWS connected?

The actions AWS’s API exposes, listed in the Available tools section of the AWS entry under `strawberry://settings/integrations`, with the read-only tools marked. Because AWS spans so many services, read that list properly rather than skimming it.

The Permissions block beneath sets each action to Ask every time, Always allow, or off, on top of the approval card consequential steps already stop at. On an AWS connection, Always allow deserves a very high bar, and a call that terminates an instance is one you want to have read.

The audit becomes a cleanup once rows have owners

A list of orphaned resources is half a job.

The other half is who owns each one, and that lives in a repository, a closed ticket, a tag nobody maintained, or a person who left. A companion reads all of those in your signed-in accounts and puts a name against every row, then opens the ticket and writes the paragraph.

That combination is operations work, and the recurring version is closer to a monthly spend review than to infrastructure management. If your estate spans several providers, ai for it admins covers the shape of it.

Get the answer that spans four systems

A companion takes the pass no tool owns: an AWS fact plus a billing fact plus a ticket plus a Slack thread, assembled into something a person can act on this morning. By hand that costs a morning every time.

Infrastructure changes belong in Terraform or CloudFormation, reviewed and idempotent, and this connection leaves them there. AWS also ships its own console assistant with account context, as of this writing, which suits a question about one service you are already looking at.

Frequently asked questions