I Tried Automatically Detecting AI Assets with AWS Security Hub's New "AI Inventory" Feature

Introduction

On July 14, 2026, an AI Inventory feature was added to AWS Security Hub.

https://aws.amazon.com/about-aws/whats-new/2026/07/aws-security-hub-ai/

As the use of AI workloads spreads across an organization, it becomes difficult to keep track of where and which AI services and models are being used.

AI Inventory is the feature responsible for visualizing these AI assets. It is included in Security Hub Essentials, and in environments where Security Hub v2 is enabled, it can be used with no additional setup and no additional cost. AI assets are automatically cataloged using the following three detection methods.

In this article, I verify "what becomes visible with no additional setup" in a real environment. I focus mainly on the results of managed detection, and also summarize how to access them through the CLI/API.

Verification Details

Verification Environment

• Security Hub v2 enabled (enabled on: 2026-07-07. Note that Security Hub v1 has been enabled since 2023-01-12)
• AWS Config enabled (recording: true)
• Amazon Bedrock in use (via SageMaker Unified Studio)
• Amazon Inspector: only ECR scanning enabled (EC2 scanning disabled)
• Amazon GuardDuty enabled (DNS logs enabled, AI Protection disabled)

The region is ap-northeast-1. This article is built entirely on CLI/API output and does not include console screenshots. The commands below were all run against the same region.

Overview of AI Inventory

First, I used get-resources-statistics-v2 to check which categories Security Hub v2 classifies resources into.

aws securityhub get-resources-statistics-v2 \
  --group-by-rules '[{"GroupByField": "ResourceCategory"}]' \
  --region ap-northeast-1

The results were as follows.

11 resources were automatically classified into the AI/ML category. This category can also be checked by applying the ResourceCategory=AI/ML filter on the console's Resources screen.

Detection of Managed AI Services

I checked which resource types make up the 11 resources in the AI/ML category.

aws securityhub get-resources-statistics-v2 \
  --group-by-rules '[{
    "Filters": {
      "CompositeFilters": [{
        "StringFilters": [{
          "FieldName": "ResourceCategory",
          "Filter": {"Comparison": "EQUALS", "Value": "AI/ML"}
        }]
      }]
    },
    "GroupByField": "ResourceType"
  }]' \
  --region ap-northeast-1

They consisted of two resource types.

The 10 AWS::Bedrock::ApplicationInferenceProfile resources were inference profiles automatically created by SageMaker Unified Studio. The models used by each profile are as follows. Of the 10, 4 are cross-region profiles, so multi-region inference configurations are also visualized.

The remaining one was AWS::OpenSearchServerless::SecurityPolicy. It is a security policy for OpenSearch Serverless used by Bedrock IDE. In this environment, not only direct inference and training resources but also security policies for infrastructure related to AI workloads were included in the AI/ML category.

These managed resources are detected automatically via AWS Config. In fact, tracking the change in the number of AI/ML resources showed that resources were backfilled the day after Security Hub v2 was enabled. I retrieved the trend with get-resources-trends-v2.

aws securityhub get-resources-trends-v2 \
  --start-time "2026-07-07T00:00:00Z" \
  --end-time "2026-07-14T23:59:59Z" \
  --filters '{
    "CompositeFilters": [{
      "StringFilters": [{
        "FieldName": "resource_category",
        "Filter": {"Comparison": "EQUALS", "Value": "AI/ML"}
      }]
    }]
  }' \
  --region ap-northeast-1

On the day of enablement (7/7) there were 0, but the next day (7/8) all 11 were registered at once, and the number remained stable afterward. In this environment, I was able to confirm that resources recorded in Config at the time Security Hub v2 was enabled are automatically cataloged the next day.

Each resource includes the following information through get-resources-v2.

Detection of Self-hosted AI Workloads

Self-hosted detection is a mechanism that detects AI frameworks on EC2 instances and container images. Its source is the SBOM (Software Bill of Materials) generated by Amazon Inspector.

In this environment, nothing was detected by this method. The images targeted by ECR scanning did not contain any AI frameworks. Also, because EC2 scanning is disabled, workloads on EC2 were outside the scope of this verification.

Detection of External AI Dependencies

External AI dependency detection is a mechanism that uses Amazon GuardDuty DNS telemetry as its source to detect communication to external AI APIs such as OpenAI.

In this environment, nothing was detected by this method either. GuardDuty DNS logs are enabled, but no communication from EC2 to external AI APIs occurred in the first place. Note that GuardDuty AI Protection (a threat detection feature for AI workloads) is disabled in this environment and is planned to be verified in the next article.

AI Security Best Practices Standard

Along with AI Inventory, a new security standard called AI Security Best Practices has been added.

{
    "StandardsArn": "arn:aws:securityhub:::standards/ai-security-best-practices/v/1.0.0",
    "Name": "AI Security Best Practices v1.0.0",
    "EnabledByDefault": false
}

This standard consists of 31 controls (8 for Bedrock, 23 for SageMaker). Because EnabledByDefault is false, it must be explicitly enabled to use it.

Among the HIGH severity controls, on the Bedrock side there is BedrockAgentCore.1 (configure the AgentCore runtime in VPC network mode). This control is also included in FSBP (AWS Foundational Security Best Practices), so it is evaluated via FSBP even if AI Security Best Practices is not enabled. On the SageMaker side, SageMaker.1 (disable direct internet access for notebooks) and others apply.

Bedrock-related controls (8)

Access via CLI/API

Through this verification, I found no operations in the Security Hub CLI/API dedicated to AI Inventory. You access it by combining get-resources-v2 with the ResourceCategory=AI/ML filter.

aws securityhub get-resources-v2 \
  --filters '{
    "CompositeFilters": [{
      "StringFilters": [{
        "FieldName": "ResourceCategory",
        "Filter": {"Comparison": "EQUALS", "Value": "AI/ML"}
      }]
    }]
  }' \
  --region ap-northeast-1

Finding Association

The FindingsSummary field of each resource is linked to related Findings, so you can review the AI asset inventory and security assessment in the same Security Hub.

In this environment, the FindingsSummary of all AI/ML resources was an empty array. I could not confirm any situation where a Finding is linked to a resource registered in AI Inventory. Possible reasons are that the AI Security Best Practices standard has not been enabled, and that no control targeting ApplicationInferenceProfile can currently be identified.

Note that there was one Bedrock-related Finding. It was a Finding for BedrockAgentCore.1 (a control included in both FSBP and AI Security Best Practices), and the target resource was AWS::BedrockAgentCore::Runtime. However, this resource type is not registered in AI Inventory.

I summarized the prerequisites for the three detection methods and the results in this environment.

Summary

I verified the AI Inventory of AWS Security Hub and confirmed that in environments where Security Hub v2 is enabled, AI assets are cataloged with no additional setup and no additional cost. In this environment, 11 resources, including Bedrock inference profiles, were registered via AWS Config the day after enablement. No AI frameworks were detected in the images targeted by ECR scanning, and EC2 was not verified. Also, because there was no relevant communication to external AI APIs, external AI dependencies were not detected either. Next time, I will verify threat detection for AI workloads with GuardDuty AI Protection.

https://dev.classmethod.jp/articles/guardduty-ai-protection-enable-and-verify/