canonical: https://jentic.com/apis/amazonaws.com/aws-resource-groups # AWS Resource Groups Jentic publishes the only available OpenAPI specification for AWS Resource Groups, keeping it validated and agent-ready. AWS Resource Groups lets you organise Amazon Web Services resources such as EC2 instances, RDS databases, and S3 buckets into logical collections defined by tag or CloudFormation stack membership. The service exposes group lifecycle operations, query-based membership rules, and account-level configuration so platform teams can apply consistent automation across many resources at once. It is the foundation for cross-resource search, batch tagging, and environment-scoped dashboards in the AWS Console. ## For AI agents Create, query, and manage logical groupings of AWS resources by tag or CloudFormation stack so agents can operate on whole environments at once. ## Scope Does not provision, modify, or delete the underlying AWS resources, and does not work cross-region or cross-account - use for organising existing in-region resources by tag or CloudFormation stack only. ## Capabilities - Create resource groups defined by tag-based or CloudFormation stack queries - List and search resources that match a group's membership query at runtime - Update group queries to expand or narrow which AWS resources belong to the group - Attach and detach individual resource ARNs from a group via GroupResources and UngroupResources - Read and write account-level Resource Groups settings such as group lifecycle event configuration - Tag and untag groups themselves to align them with cost-allocation and access-control policies ## Use cases ### Environment-scoped operations across many AWS services Platform teams use AWS Resource Groups to define a logical environment (for example, all production resources tagged Environment=prod) and then drive automation against that group rather than enumerating individual ARNs. The CreateGroup operation accepts a tag-based ResourceQuery, and ListGroupResources returns every matching resource at runtime, which keeps automation in step with infrastructure changes without manual list maintenance. Example prompt: Create a resource group named prod-web with a tag-based ResourceQuery filtering Environment=prod and Tier=web, then call ListGroupResources to return every matching ARN. ### CloudFormation stack inspection and audit FinOps and security teams group resources by CloudFormation stack membership to audit deployments without traversing individual stack outputs. AWS Resource Groups exposes a CloudFormationStackQuery group type, so a single GetGroupQuery and ListGroupResources call returns every resource a stack created - useful for verifying that a deployment landed cleanly or for tagging stack-owned resources for chargeback. Example prompt: Call CreateGroup with a CloudFormationStackQuery pointing at the my-app-prod stack, then enumerate ListGroupResources output and produce an inventory report grouped by service. ### Batch tagging and cost allocation rollouts Engineering teams use Resource Groups together with the Resource Groups Tagging API to roll out new cost-allocation tags across hundreds of resources. A group defined by an existing tag query identifies the target set, then tag operations apply the new tags atomically. This avoids ad-hoc scripting against EC2, RDS, and S3 separately and keeps the membership rule reusable for future tagging passes. Example prompt: Identify a Resource Group named cost-center-marketing, list its members, then call the Resource Groups Tagging API to apply CostCenter=marketing-2026 to every ARN returned. ### Agent-driven environment automation through Jentic AI agents that need to act on a whole environment use Jentic to call AWS Resource Groups' CreateGroup, ListGroupResources, and GetGroupQuery without holding raw AWS access keys. Jentic stores the agent's AWS credentials in your Jentic One instance, signs each request with SigV4 server-side, and returns the structured result so the agent can decide what to do next - restart, tag, snapshot, or report. Example prompt: Search Jentic for 'list resources in an AWS resource group', load the ListGroupResources schema, and execute it against the group named prod-web to retrieve all member ARNs. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /groups | Create a new resource group with a ResourceQuery | | POST | /get-group | Retrieve a group's metadata | | POST | /get-group-query | Retrieve the ResourceQuery that defines group membership | | POST | /list-group-resources | List ARNs of resources that match the group's query | | POST | /group-resources | Add resource ARNs to a group manually | | POST | /ungroup-resources | Remove resource ARNs from a group | | PUT | /resources/{Arn}/tags | Tag a resource group | | POST | /delete-group | Delete a resource group | ## Key resources - **Group** — A named collection of AWS resources defined by a tag query or CloudFormation stack query - **GroupQuery** — The ResourceQuery object that defines which resources are members of a group - **GroupConfiguration** — Per-group configuration items such as lifecycle event hooks - **Tags** — Tags applied to the group itself for access control and cost allocation - **AccountSettings** — Account-level Resource Groups configuration toggles ## Why Jentic - **Setup:** Wiring Resource Groups by hand means computing SigV4 HMAC signatures per request, routing to the correct regional resource-groups host, and handling pagination across group and resource listings yourself. Through Jentic you install once, import AWS Resource Groups from the API Directory, store your AWS access keys once, and your agent calls it with signing done per request. - **Permission scoping:** Group names and queries travel in the request body, so you limit the agent to the operations it needs, such as ListGroupResources and GetGroup for read access. Destructive operations like DeleteGroup and UngroupResources, and tag writes on /resources/{Arn}/tags, are not included unless you add them. - **Credential handling:** Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to produce a SigV4 signature per request. The raw secret access key never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list the resources in an AWS resource group', and Jentic returns the matching Resource Groups operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **AWS Resource Groups Tagging API** — Apply, remove, and query tags across many AWS resources at once - **Amazon EC2** — Manage the underlying compute instances that Resource Groups organise - **AWS Resource Access Manager** — Share AWS resources across accounts rather than grouping within one ## FAQ ### Why is there no official OpenAPI spec for AWS Resource Groups? AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Resource Groups via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the AWS Resource Groups API use? AWS Resource Groups uses AWS Signature Version 4 (SigV4) HMAC signing with an AWS access key ID and secret access key, optionally with a session token. When called through Jentic, your AWS credentials sit in your Jentic One instance and Jentic signs each request server-side, so raw access keys never enter the agent's context. ### Can I group resources across multiple AWS regions with the AWS Resource Groups API? No. Resource Groups are regional - a group lives in the region you create it in and ListGroupResources only returns matching ARNs from that region. To track a multi-region environment, create one group per region with the same tag query, or maintain region-scoped groups and aggregate results at the application layer. ### What are the rate limits for the AWS Resource Groups API? AWS does not publish a fixed RPS for Resource Groups in the spec; the service applies standard AWS API throttling (typically a token-bucket per account per region) and returns ThrottlingException on overage. Production agents should retry with exponential backoff using the AWS-recommended jitter pattern. ### How do I list every resource in a CloudFormation stack with the AWS Resource Groups API through Jentic? Search Jentic for 'list resources in an AWS resource group', load the ListGroupResources operation schema, and call POST /list-group-resources with the group name. If the group is defined by a CloudFormationStackQuery, the response will contain every ARN that stack created. Install the SDK first with pip install jentic. ### Can I use the AWS Resource Groups API to tag resources directly? Not for arbitrary AWS resources - Resource Groups can only tag the groups themselves via PUT /resources/{Arn}/tags. To tag the resources inside a group, list members with ListGroupResources and pass those ARNs to the AWS Resource Groups Tagging API's TagResources operation. ### Can I limit what my agent is allowed to do with the AWS Resource Groups API? Yes. Because you run Jentic One yourself, your own rules decide which AWS Resource Groups operations and which AWS credentials the agent may use. You can grant read-only access such as ListGroupResources and GetGroup while withholding destructive or write operations like DeleteGroup, UngroupResources, and the tag writes on /resources/{Arn}/tags, which stay unavailable to the agent unless you add them. This way the agent can query and inspect resource groups without being able to change or delete them.