AWS AI/ML Cloud Onboarding

In this section we can find the steps to onboard an AWS cloud account with AI/ML asset scanning to the AccuKnox SaaS platform.

What cloud onboarding enables

Follow the steps on this page to enable Shadow AI Discovery for your AWS account. Onboarding turns on these AI Security features:

• Model and Data Security
• Shadow AI Discovery
• Prompt Firewall for Cloud Assets

AWS IAM User Creation

Follow these steps to create an IAM user with the permissions required for AI/ML asset scanning:

Step 1: Navigate to IAM → Users and click on Add Users

Step 2: Give a username to identify the user

Step 3: In the "Set Permissions" screen:

a. Select "Attach policies directly"

b. Search "ReadOnly", Filter by Type: "AWS managed - job function" and select the policy

c. Search "SecurityAudit", Filter by Type: "AWS managed - job function" and select the policy

Step 4: Go to Add Permissions > Create inline policy and attach the following policy to grant access to AI/ML services:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AccuKnoxAIMLPermissions",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeAgent",
                "sagemaker:InvokeEndpoint",
                "sagemaker:ListTags",
                "bedrock-agentcore:InvokeAgentRuntime",
                "bedrock-agentcore:StopRuntimeSession",
                "aws-marketplace:Subscribe",
                "aws-marketplace:ViewSubscriptions"
            ],
            "Resource": "*"
        }
    ]
}

Note

aws-marketplace:Subscribe and aws-marketplace:ViewSubscriptions are required for invoking certain models (e.g., Claude Opus 4.5) that are distributed through AWS Marketplace.

Step 5: Finish creating the user. Click on the newly created user and create the Access key and Secret Key from the Security Credentials tab to be used in the AccuKnox panel

AWS Onboarding

In this example we are onboarding AWS account using the Access Keys method.

Step 1: To onboard Cloud Account, navigate to Settings → Cloud Accounts

Step 2: In the Cloud Account Page select Add Account option

Step 3: Select the AWS option

Step 4: In the next Screen select the labels and Tags field from the dropdown Menu.

Step 5: After giving labels and tag, provide the AWS account’s Access Key and Secret Access Key ID and select the region. Check the "AI/ML Assets" box to enable AI/ML asset discovery and monitoring. Click "Add Account" to complete onboarding.

Step 6: AWS account is added to AccuKnox using the Access Key method. You can view the onboarded cloud account by navigating to Settings → Cloud Accounts.

---

SCHEDULE DEMO