Your AWS role can't tell a human from an agent anymore, part 3: the SCP backstop

AWS security for agents requires a multi-layered approach to mitigate risks. Layer 3 utilizes Service Control Policies (SCPs) as a hard backstop, acting as a permissions ceiling to prevent excessive IAM access even when developers make mistakes. Layer 4 focuses on detection and observation to close the loop. By integrating CloudTrail with Athena and utilizing GuardDuty, organizations can audit agent behavior, track credential reuse, and identify anomaly findings to determine exactly what an agent touched.