Agent report card
Can an agent use AWS Cloud through API resource management?
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateLimited
- Sign upReady
- PayUnknown
- ProvisionLimited
- OperateUnknown
The pricing model is visible but omits a material variable or condition.
AWS describes a pay-as-you-go pricing model where users pay only for consumed services without long-term contracts. However, the Price List API documentation explicitly states that Price List files provide pricing details for informational purposes only and that AWS charges prices listed on individual service pricing pages.
Terms are readable but materially incomplete, ambiguous, contextual, or unstable.
Only some material eligibility conditions are decidable before commitment.
The exact service and stable evaluation or access entrypoints are publicly discoverable.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supportedOnly some material eligibility conditions are decidable before commitment.
AWS Service Terms explicitly condition tax exemption on documentation and sole-discretion review, and restrict GovCloud access to satisfied eligibility requirements validated against commercial and governmental databases. General service-wide eligibility conditions across AWS are not completely decidable from these terms alone.
Can an agent estimate cost or confirm no-charge status before commitment?
supportedThe pricing model is visible but omits a material variable or condition.
AWS describes a pay-as-you-go pricing model where users pay only for consumed services without long-term contracts. However, the Price List API documentation explicitly states that Price List files provide pricing details for informational purposes only and that AWS charges prices listed on individual service pricing pages.
Can an agent find the exact service and its stable entrypoints?
supportedThe exact service and stable evaluation or access entrypoints are publicly discoverable.
The documentation identifies AWS Cloud Control API as a standardized service for CRUD-L operations on cloud resources and documents standard programmatic API operations and AWS CLI commands.
Are verified structured discovery artifacts available?
supportedCurrent admissible evidence does not resolve this finding.
The retained documentation discusses AWS Cloud Control API and temporary security credential operations via AWS STS, but it does not establish verified structured discovery artifacts such as OpenAPI or llms.txt.
Can an agent retrieve and understand the applicable commitment terms?
supportedTerms are readable but materially incomplete, ambiguous, contextual, or unstable.
The AWS Service Terms document is retrievable and readable, incorporating specific addenda and licensing terms for various services and regions. However, the full body of general service commitment terms is materially fragmented across specific service clauses and external references.
Does the vendor deliberately describe access for web agents?
supportedCurrent admissible evidence does not resolve this finding.
The retained evidence covers general user guide documentation for Cloud Control API and IAM STS credentials. It contains no explicit policy or instructions governing web agent access.
What would improve this stage
- Publish readable complete pricing or explicit no-charge status and conditions.
A stable canonical route begins the required access bootstrap.
Documentation provides canonical instructions to begin obtaining access via the Sign up for AWS page.
Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supportedCurrent admissible evidence does not resolve this finding.
The retained page snippet only contains a page title and metadata without form controls, validation, navigation, or handoff details.
Is there a stable route to begin obtaining service access?
supportedA stable canonical route begins the required access bootstrap.
Documentation provides canonical instructions to begin obtaining access via the Sign up for AWS page.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supportedCurrent admissible evidence does not resolve this finding.
The evidence does not mention CAPTCHA presence, absence, or alternative verification routes across the evaluated targets.
Can an agent obtain scoped, revocable authority for this service?
supportedScoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
AWS STS provides temporary security credentials with session policies, access keys, and session tokens via delegated API operations like AssumeRoleWithWebIdentity.
Can required phone verification be completed through a supported boundary?
supportedCurrent admissible evidence does not resolve this finding.
Documentation requires phone verification via SMS or phone call, but does not define an explicit resumable handoff protocol for agents.
Current admissible evidence does not resolve this finding.
While documentation mentions querying prices via API and high-level pay-as-you-go or flat-rate models, it does not disclose exact charges, currency, recurrence, and material commercial conditions before authorization.
A documented direct purchase path reaches paid access without a vendor decision point.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supportedCurrent admissible evidence does not resolve this finding.
The retained documentation describes account sign-up and payment preferences, but does not establish deterministic checkout construction, safe approval handoff, and resumption mechanisms for an agent.
Is the exact commercial commitment disclosed before authorization?
supportedCurrent admissible evidence does not resolve this finding.
While documentation mentions querying prices via API and high-level pay-as-you-go or flat-rate models, it does not disclose exact charges, currency, recurrence, and material commercial conditions before authorization.
Can payment be authorized within scoped agent or explicit human authority?
supportedCurrent admissible evidence does not resolve this finding.
The documentation mentions adding a valid payment method during sign-up and managing payment methods, but does not define a rail supporting scoped delegation or explicit human-confirmed payment authorization with receipts.
Is a direct self-service path to paid access documented?
supportedA documented direct purchase path reaches paid access without a vendor decision point.
AWS documents a direct self-service sign-up procedure where an authorized user enters billing information, adds a valid payment method, chooses a Support plan, and completes account activation without vendor sales intervention.
Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Cloud Control API exposes asynchronous progress tracking via GetResourceRequestStatus with ProgressEvent and OperationStatus values like SUCCESS, but the excerpts omit explicit failure reconciliation semantics and documented time bounds.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
Credentials, grants, or configuration are delivered through a documented agent-usable flow.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supportedCredentials, grants, or configuration are delivered through a documented agent-usable flow.
AWS STS operations allow programmatic requests that return temporary security credentials, including an access key ID, secret key, and session token, for agent and application resource access.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supportedCompletion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Cloud Control API exposes asynchronous progress tracking via GetResourceRequestStatus with ProgressEvent and OperationStatus values like SUCCESS, but the excerpts omit explicit failure reconciliation semantics and documented time bounds.
Can provisioning be initiated within supported agent authority?
supportedProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
Cloud Control API provides the CreateResource action to initiate resource creation programmatically with desired state and type name parameters, returning a tracking token.
What would improve this stage
- Expose bounded machine-readable terminal status and reconciliation semantics.
Current admissible evidence does not resolve this finding.
Admitted STS evidence documents credential issuance and expiration, noting SDK credential refreshing. It does not document agent-executable revocation, compromise handling, or recovery.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Applicable limits, errors, retry, idempotency, cancellation, and reconciliation semantics are documented.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
supportedCurrent admissible evidence does not resolve this finding.
Cloud Control API documents standard REST APIs and CLI commands. Admitted evidence does not resolve or verify an agent-native protocol interface such as MCP or tool manifest across targets.
- cloud-control
- public-pricing
- workload-authentication
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supportedCurrent admissible evidence does not resolve this finding.
Admitted STS evidence documents credential issuance and expiration, noting SDK credential refreshing. It does not document agent-executable revocation, compromise handling, or recovery.
Can an agent handle applicable failure modes safely?
supportedApplicable limits, errors, retry, idempotency, cancellation, and reconciliation semantics are documented.
Cloud Control API explicitly documents idempotency via ClientToken, error codes and exceptions, retry semantics via RetryAfter, and status query reconciliation via RequestToken.
Can an agent authenticate service operations with scoped authority?
supportedRequest-time authentication is documented and usable under scoped agent authority.
AWS STS operations issue scoped temporary security credentials containing an access key ID, secret access key, and session token, subject to session policies.
Are essential operation inputs, outputs, and effects stable and decidable?
supportedEssential operations have stable readable request, response, and effect semantics.
The essential operations across Cloud Control API and Price List API have stable, decidable request parameters, endpoints, response elements, and execution semantics.
- cloud-control
- public-pricing
Can an agent perform every essential assessment target through a usable interface?
supportedEvery essential target has a stable documented agent-usable interface alternative.
Every essential target is accessible through documented machine-operable interfaces, including AWS SDKs, the AWS CLI, and regional HTTPS service endpoints.
- cloud-control
- public-pricing
What works
- Sign up: A stable canonical route begins the required access bootstrap.
What blocks agents
No stage is established as blocked.
Where autonomy is limited
- Evaluate: The pricing model is visible but omits a material variable or condition.
- Provision: Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Not yet established: Pay, Operate.
What this grade establishes
12 of 14 graded signals have current supporting evidence. 0 of 5 additional barrier checks are verified.Unknown checks are not a pass or a confirmed blocker. This report is not proof of an end-to-end purchase or service session.
How the grade is derived
A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.
Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.
Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states.
Startup offers
AWS on the startup-offers board
- Up to $200,000 in creditsAWS Activate Portfolio credits
- Up to $200,000 in creditsAWS Activate Credits
- Up to $5,000 in creditsAWS Activate Founders
- At least $200,000 in creditsAWS credits for AI startups
Distribution
The grade’s badge
One stable image resolving the record’s current live facts, linking to the canonical page. Embed it once; it keeps itself current. Placement is never evidence and never affects rank.
[](https://sourcey.com/c/aws/agent-readiness/aws-cloud/api-resource-management)Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzez1rxy9f1wce0r3p6yd35y
- Projection
- sha256:53fca3377e3aec0d816a2e48c946feda74b32125dd1983550285704ac5db0666
- Policy
- service-use-2026-09-07-blocking-barriers-r12 · sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration