AWS Resource Groups
Browse all Amazonaws APIs★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputehmac18 EndpointsREST
For Agents
Create, query, and manage logical groupings of AWS resources by tag or CloudFormation stack so agents can operate on whole environments at once.
Use for: I need to create a resource group for all EC2 instances tagged Environment=staging, List all AWS resources that belong to a specific resource group, Find all resource groups in this account that match a CloudFormation stack, Get the group query that defines membership for a Resource Group
Not supported: Does not provision, modify, or delete the underlying AWS resources, and does not work cross-region or cross-account — use for organising existing in-region resources by tag or CloudFormation stack only.
Jentic publishes the only available OpenAPI specification for AWS Resource Groups, keeping it validated and agent-ready. AWS Resource Groups lets you organise Amazon Web Services resources such as EC2 instances, RDS databases, and S3 buckets into logical collections defined by tag or CloudFormation stack membership. The service exposes group lifecycle operations, query-based membership rules, and account-level configuration so platform teams can apply consistent automation across many resources at once. It is the foundation for cross-resource search, batch tagging, and environment-scoped dashboards in the AWS Console.
Install Jentic One Beta
Connect the AWS Resource Groups to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS Resource Groups, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AWS Resource Groups API.
Create resource groups defined by tag-based or CloudFormation stack queries
List and search resources that match a group's membership query at runtime
Update group queries to expand or narrow which AWS resources belong to the group
Attach and detach individual resource ARNs from a group via GroupResources and UngroupResources
Read and write account-level Resource Groups settings such as group lifecycle event configuration
Tag and untag groups themselves to align them with cost-allocation and access-control policies
Use Cases
Patterns agents use AWS Resource Groups API for, with concrete tasks.
★ Environment-scoped operations across many AWS services
Platform teams use AWS Resource Groups to define a logical environment (for example, all production resources tagged Environment=prod) and then drive automation against that group rather than enumerating individual ARNs. The CreateGroup operation accepts a tag-based ResourceQuery, and ListGroupResources returns every matching resource at runtime, which keeps automation in step with infrastructure changes without manual list maintenance.
Create a resource group named prod-web with a tag-based ResourceQuery filtering Environment=prod and Tier=web, then call ListGroupResources to return every matching ARN.
CloudFormation stack inspection and audit
FinOps and security teams group resources by CloudFormation stack membership to audit deployments without traversing individual stack outputs. AWS Resource Groups exposes a CloudFormationStackQuery group type, so a single GetGroupQuery and ListGroupResources call returns every resource a stack created — useful for verifying that a deployment landed cleanly or for tagging stack-owned resources for chargeback.
Call CreateGroup with a CloudFormationStackQuery pointing at the my-app-prod stack, then enumerate ListGroupResources output and produce an inventory report grouped by service.
Batch tagging and cost allocation rollouts
Engineering teams use Resource Groups together with the Resource Groups Tagging API to roll out new cost-allocation tags across hundreds of resources. A group defined by an existing tag query identifies the target set, then tag operations apply the new tags atomically. This avoids ad-hoc scripting against EC2, RDS, and S3 separately and keeps the membership rule reusable for future tagging passes.
Identify a Resource Group named cost-center-marketing, list its members, then call the Resource Groups Tagging API to apply CostCenter=marketing-2026 to every ARN returned.
Agent-driven environment automation through Jentic
AI agents that need to act on a whole environment use Jentic to call AWS Resource Groups' CreateGroup, ListGroupResources, and GetGroupQuery without holding raw AWS access keys. Jentic stores the agent's AWS credentials in the MAXsystem vault, signs each request with SigV4 server-side, and returns the structured result so the agent can decide what to do next — restart, tag, snapshot, or report.
Search Jentic for 'list resources in an AWS resource group', load the ListGroupResources schema, and execute it against the group named prod-web to retrieve all member ARNs.
Key Endpoints
18 endpoints — jentic publishes the only available openapi specification for aws resource groups, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/groups
Create a new resource group with a ResourceQuery
POST
/get-group
Retrieve a group's metadata
POST
/get-group-query
Retrieve the ResourceQuery that defines group membership
POST
/list-group-resources
List ARNs of resources that match the group's query
POST
/group-resources
Add resource ARNs to a group manually
POST
/ungroup-resources
Remove resource ARNs from a group
PUT
/resources/{Arn}/tags
Tag a resource group
POST
/delete-group
Delete a resource group
POST
/groups
Create a new resource group with a ResourceQuery
POST
/get-group
Retrieve a group's metadata
POST
/get-group-query
Retrieve the ResourceQuery that defines group membership
POST
/list-group-resources
List ARNs of resources that match the group's query
POST
/group-resources
Add resource ARNs to a group manually
POST
/ungroup-resources
Remove resource ARNs from a group
PUT
/resources/{Arn}/tags
Tag a resource group
POST
/delete-group
Delete a resource group
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
AWS access keys are stored encrypted in the Jentic vault (MAXsystem). Each Resource Groups call is signed with SigV4 server-side and the agent only sees scoped, short-lived authorisation — raw access keys never enter the agent's context.
Intent-based discovery
Agents search by intent (e.g., 'list resources in an AWS resource group') and Jentic returns the matching Resource Groups operations with their input schemas, so the agent calls the right endpoint without browsing AWS docs.
Time to first call
Direct AWS Resource Groups integration: 1-2 days for SigV4 signing, error handling, and pagination. Through Jentic: under 30 minutes — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AWS Resource Groups API through Jentic.
Why is there no official OpenAPI spec for AWS Resource Groups?
AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Resource Groups via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the AWS Resource Groups API use?
AWS Resource Groups uses AWS Signature Version 4 (SigV4) HMAC signing with an AWS access key ID and secret access key, optionally with a session token. When called through Jentic, your AWS credentials sit in the MAXsystem vault and Jentic signs each request server-side, so raw access keys never enter the agent's context.
Can I group resources across multiple AWS regions with the AWS Resource Groups API?
No. Resource Groups are regional — a group lives in the region you create it in and ListGroupResources only returns matching ARNs from that region. To track a multi-region environment, create one group per region with the same tag query, or maintain region-scoped groups and aggregate results at the application layer.
What are the rate limits for the AWS Resource Groups API?
AWS does not publish a fixed RPS for Resource Groups in the spec; the service applies standard AWS API throttling (typically a token-bucket per account per region) and returns ThrottlingException on overage. Production agents should retry with exponential backoff using the AWS-recommended jitter pattern.
How do I list every resource in a CloudFormation stack with the AWS Resource Groups API through Jentic?
Search Jentic for 'list resources in an AWS resource group', load the ListGroupResources operation schema, and call POST /list-group-resources with the group name. If the group is defined by a CloudFormationStackQuery, the response will contain every ARN that stack created. Install the SDK first with pip install jentic.
Can I use the AWS Resource Groups API to tag resources directly?
Not for arbitrary AWS resources — Resource Groups can only tag the groups themselves via PUT /resources/{Arn}/tags. To tag the resources inside a group, list members with ListGroupResources and pass those ARNs to the AWS Resource Groups Tagging API's TagResources operation.
GET STARTED