generated: '2026-06-20'
method: searched
source: probed /.well-known/ on the AppFlow regional endpoint and the aws.amazon.com host
notes: >-
  The AppFlow regional API endpoint (appflow.{region}.amazonaws.com) requires AWS
  SigV4 on every request and returns 403 for all unauthenticated /.well-known/
  probes; it exposes no public discovery documents. A valid RFC 9116 security.txt
  is published at the aws.amazon.com corporate host and is captured here.
hosts:
- host: https://appflow.us-east-1.amazonaws.com
  documents:
  - path: /.well-known/security.txt
    status: 403
  - path: /.well-known/openid-configuration
    status: 403
  - path: /.well-known/oauth-authorization-server
    status: 403
  - path: /.well-known/api-catalog
    status: 403
  - path: /.well-known/ai-plugin.json
    status: 403
- host: https://aws.amazon.com
  documents:
  - path: /.well-known/security.txt
    status: 200
    file: amazon-appflow-security.txt
  - path: /.well-known/ai-plugin.json
    status: 301
  - path: /.well-known/api-catalog
    status: 301