Skip to main content

Connect AWS

Waxell discovers and governs the agents your organization runs in Amazon Bedrock AgentCore — runtimes and gateways — in a single account or across your entire AWS Organization.

Onboarding launches a CloudFormation stack that creates a read-only, cross-account IAM role Waxell can assume. No credentials ever leave your account: Waxell assumes the role only when presenting the unique External ID generated for your connection. Remove the stack to revoke access at any time.

What Waxell can see​

Read-only, gated by the External ID:

  • Agent inventory — bedrock-agentcore:List/Get AgentRuntimes and List/Get Gateways.
  • Activity — cloudtrail:LookupEvents for AgentCore control-plane events, turned into governed runs.

Connect a single account​

  1. In Waxell, go to Governance → Agent Discovery → Connect and choose AWS Bedrock AgentCore. Save the connection — Waxell generates your External ID (it always starts with wax-).
  2. Launch the Waxell Discovery CloudFormation template from the connection screen (Create stack), passing that External ID. The stack creates a role named WaxellDiscovery that trusts the Waxell platform account (325163927515) only under your External ID.
  3. Copy the stack's RoleArn output and paste it back into the Waxell connection.
  4. Click Sync.

The role is least-privilege and read-only; the External ID is server-generated so the role can never be assumed by anyone else.

CloudTrail scope

cloudtrail:LookupEvents cannot be restricted to a single event source in IAM, so the role can read your account's 90-day CloudTrail management history. Waxell queries and stores only AgentCore event sources. Per-tool-call data events are off by default — enable CloudTrail data events for InvokeAgentRuntime if you want that depth.

Connect a whole AWS Organization​

For many accounts, deploy once from your Organizations management account — no per-account launch.

  1. Enumeration role (management account, once). Launch the Waxell Org Enumeration template with your connection's External ID. It creates a read-only role that lets Waxell list your member accounts (Organizations list/describe only — no workload access). Paste its RoleArn into Waxell.

  2. Discovery role StackSet (all member accounts). Deploy the Waxell Discovery template as a service-managed StackSet targeting the organizational unit(s) whose accounts run AgentCore:

    aws cloudformation create-stack-set \
      --stack-set-name WaxellDiscovery \
      --template-body file://waxell-discovery-role-stackset.yaml \
      --capabilities CAPABILITY_NAMED_IAM \
      --permission-model SERVICE_MANAGED \
      --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false \
      --parameters ParameterKey=ExternalId,ParameterValue=wax-XXXXXXXXXXXXXXXXXXXX

    aws cloudformation create-stack-instances \
      --stack-set-name WaxellDiscovery \
      --deployment-targets OrganizationalUnitIds=ou-xxxx-xxxxxxxx \
      --regions us-east-1

The StackSet stamps the same WaxellDiscovery role into every member account (and into new accounts as they join the OU). Waxell enumerates the accounts through the management-account role and discovers agents in each — one deploy, whole org.

tip

IAM roles are global, so the StackSet needs only a single region. activate-organizations-access (trusted access for CloudFormation StackSets) is the one prerequisite for the service-managed model.

What you get​

Discovered AWS agents appear in your cross-cloud fleet under Governance → Agent Discovery, alongside your Microsoft and Google agents; their activity flows onto the Executions screen. Agents from different accounts are namespaced by account, so nothing collides.

Revoking access​

Delete the CloudFormation stack (or the StackSet's instances) to revoke the discovery role org-wide, and delete the enumeration-role stack to stop account discovery. Removing the connection in Waxell also ends access. Discovered inventory is retained as history until you remove it.