setting-up-cloudwatch-observability
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Verified External Downloads: The skill references and downloads components (ADOT SDKs, CloudWatch Agents) from trusted, official sources including AWS-managed GitHub repositories and S3 buckets.
- Least-Privilege IAM Guidance: Instructions for creating IAM roles for EC2, ECS, and Lambda include specific managed policies like
CloudWatchAgentServerPolicyandAWSXRayDaemonWriteAccess, and provide guidance on resource scoping for enhanced security. - Safe Handling of Credentials: The procedural guidance for instrumenting AI agents explicitly instructs users not to share API keys or secrets in the chat, instead advising the use of environment variables or local configuration files.
- Local Execution for Verification: The skill utilizes standard system tools (
nc,curl,kubectl) to perform local diagnostics and verify that observability agents are correctly listening on the intended ports. - Mitigation for Indirect Prompt Injection: The skill includes explicit instructions for the AI agent to treat fetched external documentation as reference data only, disregarding any potential instructions within those files that might attempt to override agent behavior.
Audit Metadata