Can an agent create a storage bucket with AWS Cloud?
Who does each step
Whether the agent handles it alone or a person has to step in.
- 01
Discover
Workaround · setupAn agent cannot find the job's interface, or how to call it, from the vendor's machine-readable documents; a person tells it once.
- 02
Authority
Workaround · setupA person hands the agent a key or token.
- 03
Onboard
Workaround · setupA person signs up, or registers a client, for the agent.
- 04
Pay
Workaround · setupA person puts a card on file once, at the vendor's checkout.
- 05
Confirm
MachineA failure comes back typed, in its answer or as its spec declares, so an agent can tell a failure from a success.
- 06
Sustain
Workaround · setupA person replaces or revokes the agent's access when it must change.
A person once, at Discover: telling the agent where the interface is or how to call it.
A person once, at Authority: handing over a key or token.
A person once, at Onboard: signing up or registering a client for the agent.
A person once, at Pay: paying for it.
A person once, at Sustain: renewing, replacing or revoking its access.
Not A+ yet: a descriptor on aws.amazon.com for AWS Cloud, with a spec that covers the job, would let an agent find it alone; OAuth that lets an agent register its own client would turn handing over a key or token into a one-time consent; a way for agents to register (auth.md, a sign-up API, or OAuth with client registration) would let the agent register itself; payment inside the request (x402 or MPP) would let an agent pay its own way; a key-management API, or OAuth refresh and revocation, would let the agent keep its access alive.
Agent surfaces
The probe
Each request it sent and what came back; the descriptors it read, counted, with what they named.
Discover70 descriptor reads5 facts
- Found
- OAuthaws-mcp.us-east-1.api.aws/mcpOAuthus-east-1.oauth.signin.awsOAuthaws-mcp.us-east-1.api.aws/mcpOAuthus-east-1.oauth.signin.awsFor agentsdocs.aws.amazon.com/llms.txt
- From
- aws-mcp.us-east-1.api.aws/.well-known/oauth-protected-resource/mcp · aws-mcp.us-east-1.api.aws/.well-known/oauth-protected-resource · docs.aws.amazon.com/llms.txt
- This endpoint
- s3.us-east-1.amazonaws.com is named by none of them
Job requestPUT s3.us-east-1.amazonaws.com/sourcey-probe-000040343 ms
- Request
- PUT https://s3.us-east-1.amazonaws.com/sourcey-probe-0000
- Response
- 403 · application/xml · 310 bytes
- Body
- sha256:9bb09309e6b9eafbf365ca64bbe355124cfd86a55e831d6d35b764fc6791a5ad
- Exchange
- sha256:9d0a055d67f58237e8d3de87121b3bbf678d0b4f719943b42ac1ade9fe947545
Resource metadataGET s3.us-east-1.amazonaws.com/.well-known/oauth-protected-resource/sourcey-probe-000040353 ms
- Request
- GET https://s3.us-east-1.amazonaws.com/.well-known/oauth-protected-resource/sourcey-probe-0000
- Response
- 403 · application/xml · 263 bytes
- Body
- sha256:6fcc066154cd631d5acba82586b8f7e87e7e009f35504c71b97092d5c482c062
- Exchange
- sha256:6ba890cba2cb8307ee4d481e25ae7371b7206ea492dd21d95119241a8d223922
Resource metadataGET s3.us-east-1.amazonaws.com/.well-known/oauth-protected-resource40351 ms
- Request
- GET https://s3.us-east-1.amazonaws.com/.well-known/oauth-protected-resource
- Response
- 403 · application/xml · 263 bytes
- Body
- sha256:9dd859feed3e6705588ab56393f14564acaf1fe21661aa0fcd31ba9cfd2160c5
- Exchange
- sha256:fb90b85b5fd7f1806248a4f59d3f5f3eea8638748ee53a8b3704e423c0dd4251
Job requestsession openedPOST aws-mcp.us-east-1.api.aws/mcp400201 ms
- Request
- POST https://aws-mcp.us-east-1.api.aws/mcp
- Response
- 400 · application/json · 234 bytes
- Body
- sha256:d76c8080005ba03cd61770e939168b25a1cf2a3caf7923bf17038f5b95ed7c47
- Exchange
- sha256:7fbb251f91f4d2f49bd321ffd12851a0d4664c3d86c221a5eb3e409cf3e3cca5
Job requestsession openedPOST aws-mcp.us-east-1.api.aws/mcp200221 ms
- Request
- POST https://aws-mcp.us-east-1.api.aws/mcp
- Response
- 200 · application/json · 820 bytes
- Body
- sha256:e2d2e4c30d83fcc22566b50a6fdb2884543341919feb88285ae1a49680543ea6
- Exchange
- sha256:06995f2d4c078ece27d73adb5e56f93600ccee4bfd74083c2138e3ab35a17f6b
Job requestsession openedPOST aws-mcp.us-east-1.api.aws/mcp20268 ms
- Request
- POST https://aws-mcp.us-east-1.api.aws/mcp
- Response
- 202 · application/json · 2 bytes
- Body
- sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- Exchange
- sha256:8e5971f58679d832e79c71c6c1472cb468ef58f95d6892b388490c22190ce8a0
Job requesttools listedPOST aws-mcp.us-east-1.api.aws/mcp200265 ms
- Request
- POST https://aws-mcp.us-east-1.api.aws/mcp
- Response
- 200 · application/json · 12960 bytes
- Body
- sha256:349c90bbc3b14b91b111800244e58a4c2bb8f7141b25870d9d3de513a9eafa52
- Exchange
- sha256:beccfc5f8085338b58f41717a3c353a949d631cb2c210e63300d3f3a91f011d2
Job requestPOST aws-mcp.us-east-1.api.aws/mcp401203 ms
- Request
- POST https://aws-mcp.us-east-1.api.aws/mcp
- Response
- 401 · application/json · 239 bytes
- Body
- sha256:ac75a0bbab99766d36d4829b7a99608988d5a61195aed16b706a7c1fbd518dd4
- Exchange
- sha256:42e2ebb2bddab97c09bca9a488af2cfbc0650cd243a8a60f9783efdf271173df
Job requestsession closedDELETE aws-mcp.us-east-1.api.aws/mcp401208 ms
- Request
- DELETE https://aws-mcp.us-east-1.api.aws/mcp
- Response
- 401 · application/json · 2 bytes
- Body
- sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- Exchange
- sha256:b195132bf08d7ffbe3c6611c3c251c65c9f0f30db112e35732bc546b76275b15
Resource metadataGET aws-mcp.us-east-1.api.aws/.well-known/oauth-protected-resource20085 ms
- Request
- GET https://aws-mcp.us-east-1.api.aws/.well-known/oauth-protected-resource
- Response
- 200 · application/json · 116 bytes
- Body
- sha256:4105d394ba9e5df54db8aa71579cb095dcca3ad26ad2657518eb2306818e188b
- Exchange
- sha256:46122bc42ad97d0ab4e76bee8d5990fa7565d59404e4e4f45da9a8a1c3efbfc3
Authorization serverGET us-east-1.oauth.signin.aws/.well-known/oauth-authorization-server20046 ms
- Request
- GET https://us-east-1.oauth.signin.aws/.well-known/oauth-authorization-server
- Response
- 200 · application/json · 505 bytes
- Body
- sha256:f816e7618f1a27f73f750fc59b22f7428b52fca6fb16960b16f8f0db5938980b
- Exchange
- sha256:c3e69f347eb632d282980bd5e6cf10387c4150f8bdd119b0976b385c7c7f6a82
Client registrationPOST us-east-1.oauth.signin.aws/v1/register40035 ms
- Request
- POST https://us-east-1.oauth.signin.aws/v1/register
- Response
- 400 · application/json · 166 bytes
- Body
- sha256:e6fc3ffcae61357ec8711613d1c3b6255c861f8605eba8a493e1a9d2dbfe61a0
- Exchange
- sha256:c2a54e52bef78a9ce30d6aa96d2d0c04d001b69a1b1189d7ec37b80b32600bcd
Declared pageGET signin.aws.amazon.com/signup?request_type=register200160 ms
- Request
- GET https://signin.aws.amazon.com/signup?request_type=register
- Response
- 200 · text/html · 5931 bytes
- Body
- sha256:347c303acae626a160c17e2ccd67a6c5f9a702542dcd7a9f7f0401b342e75429
- Exchange
- sha256:09ddf4c2c30840df4fa17b81fc876b1c6d359e107d724a89e472b68d1fe35043
Declared pageGET docs.aws.amazon.com/accounts/latest/reference/getting-started.html200123 ms
- Request
- GET https://docs.aws.amazon.com/accounts/latest/reference/getting-started.html
- Response
- 200 · text/html · 26969 bytes
- Body
- sha256:586e0610ab5d7cfcf69619217b412377f708e8920f90bb515fbddd4bc46e8b68
- Exchange
- sha256:18ae11d5ed8118b0366bf1b0020dd217b2ede91f74ae43bb5e995c331b7e857d
Declared pageGET docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-payments.html200192 ms
- Request
- GET https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-payments.html
- Response
- 200 · text/html · 13678 bytes
- Body
- sha256:13b1fe025c8b61938e803ac719959e193e236f2c912a97ad34e41878bad0994d
- Exchange
- sha256:24fc3baf6298f9d7fe5cca9a733d182559db9617e385cb0f405b5aea6e888eb1
AWS on the startup-offers board
- Up to $200,000 in creditsAWS Activate Portfolio credits
- Up to $200,000 in creditsAWS Activate Credits
- Up to $5,000 in creditsAWS Activate Founders
- At least $200,000 in creditsAWS credits for AI startups
The grade’s badge
One image that keeps itself current, linking here.
[](https://sourcey.com/c/aws/agent-readiness/aws-cloud/bucket-create)Improve the report
Correct it, probe it again, or improve the path.
- Profile
- arp_01m4pm0jfkk65gb1vt8f2vbdta
- Projection
- sha256:70979a53a85e515437547b425f54a0b23dc3c359081442b1526b2653097520bf
- Policy
- kind-2026-10-12 · sha256:0a4e4996176ce674b4f3ce910c5fca4f37c9b53bcdf51656d53a1a92fcf2c879
A report or a reassessment request names this profile, its revision and its projection. How report cards are assessed →View the exact declaration