Every agent, every credential, every object - it's all in your access logs. reCost reads them so you can see what your autonomous systems are actually doing in your cloud storage.
Book a DemoOne S3 server access log line carries everything needed to identify an agent and what it did. No SDK in the agent, no proxy in front of the bucket.
79a59df900b949e5 prod-data-lake [06/Jul/2026:03:14:22 +0000] 203.0.113.42 arn:aws:sts::123456789012:assumed-role/rag-agent-role/i-0f3e2a 3E57427F3EXAMPLE REST.GET.OBJECT pii-exports/2023/users-000481.parquet "GET /pii-exports/2023/users-000481.parquet HTTP/1.1" 200 - 8388608 - 41 40 "-" "Boto3/1.9.253 Python/3.6.9 Botocore/1.12.253"Machine identities fingerprinted from access patterns and user-agents - including the ones nobody registered.
Dormant objects suddenly read in bulk get flagged, whoever - or whatever - woke them.
New prefixes, bulk reads, odd hours: compromised agent credentials leave an unmistakable log trail.
An agent looping your hottest bucket 2M times a day shows up here before it shows up on your bill.
EOL SDK versions and long-dead credentials still touching data, straight from the user-agent field.
| Identity | Fingerprint (SDK / user-agent) | First seen | Objects touched | Status |
|---|---|---|---|---|
| rag-agent-role | Boto3/1.34.x Python/3.11 | 2025-09-02 | 1.2M | Approved |
| etl-pipeline-role | Glue/4.0 aws-sdk-java | 2024-03-18 | 8.4M | Approved |
| support-copilot-role | Boto3/1.33.x Python/3.10 | 2025-11-27 | 310K | Approved |
| assumed-role/i-0f3e2a | Boto3/1.9.253 Python/3.6 (EOL, CVE-era) | 2026-05-14 | 740K | Unregistered |
| vendor-sync-user | aws-cli/1.16.x | 2026-06-01 | 56K | Unregistered |
| notebook-role/j-88 | LangChain/0.2 Boto3/1.34 | 2026-06-19 | 2.1M | Unregistered |
| batch-export-role | Boto3/1.28.x Python/3.9 | 2026-06-30 | 97K | Unregistered |
| legacy-backup-user | s3cmd/2.0 | 2022-01-11 | 12K | Stale credential |
The question is not who can see object-level activity - it is what seeing it costs at scale. Posture tools and reCost answer different questions - see reCost vs. DSPM for the full comparison.
| CloudTrail (mgmt events) | SIEM (typical config) | DSPM | reCost | |
|---|---|---|---|---|
| Object-level read visibility | Yes, with data events enabled - priced per event (~$100K/mo at 100B req at list price) | Only what you ingest | Posture-first tools: no. Activity/DDR modules: partial | Yes - every request, every object |
| Agent fingerprinting (user-agent + pattern) | In data events, at the same per-event cost | Possible, rarely configured | Not from storage access logs | Yes - built in |
| Dormant-data access flag | No | Requires custom correlation | No | Yes - baseline per prefix |
| Cost at 100B+ requests/month | Data events priced per event | Per-GB ingest becomes prohibitive | N/A (doesn't ingest activity) | Flat - built for this volume |
| Requires agent / proxy install | No | Collectors / forwarders | Scanner permissions | No - reads existing logs |
reCost analyzes your S3 server access logs and fingerprints agent traffic by access pattern and user-agent string. You see which agent identities read which objects, when, and how much - without installing anything in the agent or the bucket.
Yes. reCost identifies machine-like access behavior across all identities in your access logs, including agents nobody registered. Identities that behave like agents but aren't on your approved list are surfaced for review.
Compromised agent credentials show distinctive patterns in access logs: reads against new prefixes, bulk downloads, activity at unusual hours, and access to long-dormant data. reCost flags these deviations from each identity's established baseline.
No. reCost is agentless and read-only. It works from the S3 access logs and inventory you already have. A read-only IAM role connects it in about 5 minutes.
Agentless monitoring for your agents. Read-only. Connected in 5 minutes.
Book a DemoWorks with your existing AWS setup. Read-only access. No agents. No data exposure.
Book a Demo