Skip to content

AWS Native Integrations

Developer Reference

This page covers internal implementation details. It is not included in the User Guide.

AWS data sources Escher reads from. Each row is verified against the corresponding script in v2-skills/ or a dedicated repo.


Verified data sources

These have a working script or service in the org today.

AWS serviceSource repo / scriptUsed by
EC2v2-skills/estate-scan/aws/ec2-details-*.shInfra Ops, SecOps, FinOps
S3v2-skills/estate-scan/aws/s3-details-*.shSecOps, Compliance
IAMv2-skills/estate-scan/aws/iam-details-*.sh; deeper analysis via v4-adk/iam-security-agent/IAM, Compliance
RDSv2-skills/estate-scan/aws/rds-details-*.shData Ops, Compliance
VPCv2-skills/estate-scan/aws/vpc-details-*.shInfra Ops, SecOps
CloudTrailReachable via v2-cloudwatch-service-go query patterns; referenced in iam-security-agent capabilitiesIAM, Compliance
CloudWatch (Metrics + Logs)v2-cloudwatch-service-go (replaces archived Python version)DevOps, IAM
Cost Explorerv2-skills/cost/aws/aws_cost_report.shFinOps
AWS API (general)v2-tauri-plugin-scanner-aws (Rust scanner plugin) drives in-app scansAll

Roadmap (no shipped script today)

These services are referenced in the v4 architecture spec but have no corresponding script in v2-skills/ or a dedicated reader repo:

  • AWS Config
  • Security Hub
  • GuardDuty
  • AWS Organizations
  • Lambda inventory (no lambda-details-*.sh script in v2-skills/)

When they ship, this list moves up to the verified table.


Read-only guarantee

Escher never calls mutating AWS APIs during scan or skill execution. The shipped scripts in v2-skills/ are all Describe*, List*, Get* calls. Mutations only happen through the Playbook flow (currently v3-playbook-agent-go) with explicit human approval.


Next steps

Escher — Agentic CloudOps by Tessell