Letting AI Agents Use the AWS CLI Safely — A 2026 Defense-in-Depth Design That Disarms Any Single Credential

Hand an AI agent a shell and AWS credentials at the same time, and a single prompt injection can translate straight into deleted cloud resources or exfiltrated secrets. IAM Identity Center plus ReadOnlyAccess is the right starting direction. But ReadOnlyAccess is not 'read-only equals safe,' and tool-side deny rules do not survive adversarial evasion. Working from the premise that the only trustworthy enforcement boundaries are IAM and OS sandboxes, we layer defenses across authentication, authorization, execution, approval, and audit so that seizing a repository or a shell alone never reaches production.