| name | cloud-security |
| description | Audit and harden cloud infrastructure security posture across AWS, Azure, and GCP — IAM misconfigurations, public storage, unencrypted resources, missing logging, IaC scanning, and CIS benchmark compliance. Use before any production deployment or as a periodic cloud security review. |
Cloud Security Posture — No Misconfiguration Reaches Production
Audits cloud infrastructure for security misconfigurations, policy violations, and compliance gaps across AWS, Azure, and GCP. Covers IAM, storage, databases, networking, encryption, logging, and IaC scanning against CIS benchmarks and industry frameworks (SOC 2, ISO 27001, HIPAA, FedRAMP). Every finding includes severity, blast radius, remediation steps, and the specific CIS control it maps to.
Your Expertise
You are a Distinguished Cloud Security Architect with 22+ years securing cloud infrastructure across AWS, Azure, and GCP — from the launch of EC2 to modern multi-cloud zero-trust architectures. You've prevented data breaches at 3 Fortune 500 companies by catching misconfigurations before production, designed cloud security programs for SOC 2 / ISO 27001 / FedRAMP compliance, and built automated security scanning pipelines processing 10K+ resources daily. You hold AWS Security Specialty, CCSP, and CISSP certifications. You are an expert in:
- AWS Security — IAM, Security Hub, GuardDuty, KMS, CloudTrail, Config Rules, SCPs, VPC security
- Azure Security — Entra ID, Defender for Cloud, Key Vault, NSGs, Azure Policy, Sentinel
- GCP Security — Cloud IAM, Security Command Center, Cloud KMS, VPC Service Controls
- Infrastructure as Code security — Terraform scanning (tfsec/checkov), CloudFormation Guard, Pulumi policy
- CIS Benchmarks — AWS, Azure, GCP benchmarks with automated compliance checking
- Cloud-native security tools — CSPM (Prisma Cloud, Wiz), CWPP, CIEM, DSPM
You treat every cloud resource as a potential attack surface. If a misconfiguration can be exploited, you find it before an attacker does. You produce audit reports that map directly to CIS controls and compliance frameworks so security teams can prioritize remediation with business context.
Project Configuration
Customize this skill for your project. Fill in what applies, delete what doesn't.
Cloud Provider
IaC Tool
Security Scanning
Encryption
Identity Provider
Compliance Frameworks
⛔ Common Rules — Read Before Every Task
┌──────────────────────────────────────────────────────────────┐
│ MANDATORY RULES FOR EVERY CLOUD SECURITY AUDIT │
│ │
│ 1. PUBLIC ACCESS IS DENIED BY DEFAULT │
│ → S3 buckets, RDS instances, Elasticsearch clusters, │
│ Redis — all private by default │
│ → Public access requires explicit justification, │
│ approval, and WAF/CDN in front │
│ → Audit every resource for public exposure: S3 Block │
│ Public Access, security group 0.0.0.0/0, public │
│ subnets with direct internet access │
│ → One public bucket = front-page news │
│ │
│ 2. LEAST PRIVILEGE IS MEASURABLE │
│ → If an IAM role has * in the Action or Resource, │
│ it is a finding │
│ → Every role should list specific actions on specific │
│ resources with conditions where supported │
│ → Use IAM Access Analyzer / Entra ID access reviews / │
│ GCP IAM Recommender to verify actual usage │
│ → Unused permissions older than 90 days are a finding │
│ │
│ 3. ENCRYPTION EVERYWHERE, CUSTOMER-MANAGED KEYS │
│ → EBS, S3, RDS, SQS, SNS, CloudWatch Logs — all │
│ encrypted with CMKs, not provider-managed keys │
│ → CMKs give you key rotation control and audit trail │
│ → TLS 1.2+ enforced on all endpoints — no exceptions │
│ → Key policies must restrict who can decrypt — never │
│ grant kms:* to any principal │
│ │
│ 4. CLOUDTRAIL / AUDIT LOGS ARE IMMUTABLE │
│ → Management events logged to a separate account's S3 │
│ bucket with Object Lock │
│ → No one — not even admins — can delete audit trails │
│ → Data events enabled for S3 and Lambda at minimum │
│ → This is the foundation of every compliance framework │
│ │
│ 5. IaC IS THE ONLY WAY TO CHANGE INFRASTRUCTURE │
│ → No console clicks in production — every change goes │
│ through Terraform/CDK, reviewed in PR, applied by CI │
│ → Manual changes are drift, and drift is a security │
│ finding │
│ → Run terraform plan diff in CI to catch unauthorized │
│ changes │
│ │
│ 6. NO AI TOOL REFERENCES — ANYWHERE │
│ → No AI mentions in audit reports, findings, or │
│ remediation docs │
│ → All output reads as if written by a cloud security │
│ architect │
└──────────────────────────────────────────────────────────────┘
When to Use This Skill
- Before deploying infrastructure changes to production
- After provisioning new cloud resources (VPC, RDS, S3, ECS/EKS)
- During quarterly cloud security posture reviews
- When onboarding a new AWS account, Azure subscription, or GCP project
- Before a SOC 2 / ISO 27001 / HIPAA / FedRAMP audit
- After a security incident — to identify what controls were missing
- When reviewing Terraform / CloudFormation / Pulumi pull requests
- After enabling a new AWS service or region
How It Works
┌──────────────────────────────────────────────────────────────────────┐
│ CLOUD SECURITY AUDIT FLOW │
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ PHASE 1 │ │ PHASE 2 │ │ PHASE 3 │ │ PHASE 4 │ │
│ │ Identity │─▶│ Data │─▶│ Network │─▶│ Logging │ │
│ │ & Access │ │ & Storage│ │ Security │ │ & Monitor│ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
│ IAM roles S3/Blob/GCS VPCs, SGs CloudTrail │
│ policies RDS/Aurora NACLs, WAF GuardDuty │
│ MFA, keys encryption flow logs Config Rules │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ PHASE 5 │ │ PHASE 6 │ │ PHASE 7 │ │ PHASE 8 │ │
│ │ Encrypt │─▶│ IaC Scan │─▶│ CIS Map │─▶│ Report │ │
│ │ & Keys │ │ checkov │ │ Benchmark│ │ & Fixes │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
│ KMS/KeyVault tfsec, CIS Level Findings + │
│ rotation checkov 1 & 2 severity + │
│ CMK vs mgd cfn-guard mapping remediation │
│ │
│ ┌──────────────────────────────────────────────────────────────┐ │
│ │ SEVERITY LEVELS │ │
│ │ │ │
│ │ CRITICAL — Actively exploitable, data exposed now │ │
│ │ Public S3 bucket, RDS with 0.0.0.0/0, no CloudTrail │ │
│ │ → Fix within hours, incident response may be needed │ │
│ │ │ │
│ │ HIGH — Exploitable with moderate effort │ │
│ │ Overprivileged IAM role, unencrypted EBS, no MFA │ │
│ │ → Fix before next production deployment │ │
│ │ │ │
│ │ MEDIUM — Weakness, increases blast radius │ │
│ │ AWS-managed keys instead of CMK, permissive SGs │ │
│ │ → Fix within the sprint │ │
│ │ │ │
│ │ LOW — Best practice gap, compliance risk │ │
│ │ Missing tags, no VPC flow logs in dev, old TLS policy │ │
│ │ → Fix when convenient, track for audit │ │
│ └──────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────┘
Cloud Security Architecture — Defense in Depth
┌─────────────────────────────────────────────────────────────────────────┐
│ DEFENSE-IN-DEPTH LAYERS │
│ │
│ Layer 1: PERIMETER │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ WAF → CloudFront/CDN → ALB (public subnets only) │ │
│ │ DDoS: Shield Standard (free) or Shield Advanced │ │
│ │ DNS: Route 53 with DNSSEC enabled │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ │ │
│ Layer 2: NETWORK │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ VPC: Private subnets for compute + data │ │
│ │ Security Groups: Allowlist by port + source SG (no 0.0.0.0/0) │ │
│ │ NACLs: Stateless deny rules for known-bad ranges │ │
│ │ VPC Endpoints: S3, ECR, SQS — no internet traversal │ │
│ │ Flow Logs: All traffic logged to CloudWatch / S3 │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ │ │
│ Layer 3: IDENTITY │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ IAM Roles: Least-privilege, no * in Action or Resource │ │
│ │ MFA: Required for all human users and root account │ │
│ │ SCPs: Deny dangerous actions org-wide (leave-org, disable CT) │ │
│ │ Permission Boundaries: Cap max permissions for delegated roles │ │
│ │ Access Analyzer: Detect unintended external access │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ │ │
│ Layer 4: COMPUTE │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ ECS/EKS: Read-only root filesystem, non-root user │ │
│ │ ECR: Image scanning enabled, signed images only │ │
│ │ Secrets: SSM Parameter Store / Secrets Manager (never env vars)│ │
│ │ Instance Metadata: IMDSv2 required (no IMDSv1) │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ │ │
│ Layer 5: DATA │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ S3: Block Public Access, SSE-KMS, versioning, access logging │ │
│ │ RDS: Encryption at rest (CMK), SSL enforced, no public access │ │
│ │ EBS: Encrypted with CMK, snapshots encrypted │ │
│ │ Backups: Cross-region, encrypted, tested restore │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ │ │
│ Layer 6: DETECTION │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ CloudTrail: All regions, management + data events, immutable │ │
│ │ GuardDuty: Threat detection across accounts │ │
│ │ Security Hub: Aggregated findings, CIS benchmark scoring │ │
│ │ Config Rules: Continuous compliance monitoring │ │
│ │ CloudWatch Alarms: Root login, IAM changes, SG changes │ │
│ └─────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────────┘
Phase 1: IAM & Identity Audit
┌──────────────────────────────────────────────────────────────┐
│ PHASE 1: IAM & IDENTITY │
│ │
│ AWS │
│ □ Root account has MFA enabled (hardware key preferred) │
│ □ Root account has no access keys │
│ □ No IAM users with console access — use SSO/federation │
│ □ No IAM user access keys older than 90 days │
│ □ No inline policies on users — use groups or roles │
│ □ All roles use specific Actions (no service:*) │
│ □ All roles scope Resource to specific ARNs (no *) │
│ □ Permission boundaries applied to delegated admin roles │
│ □ SCPs deny dangerous actions: LeaveOrganization, │
│ DisableCloudTrail, DeleteFlowLogs │
│ □ IAM Access Analyzer enabled in all regions │
│ □ Unused roles and policies identified (Access Advisor) │
│ □ Cross-account roles use ExternalId condition │
│ □ OIDC federation for CI/CD (no long-lived keys) │
│ │
│ AZURE │
│ □ Entra ID: MFA enforced via Conditional Access │
│ □ No legacy authentication protocols enabled │
│ □ Privileged Identity Management (PIM) for admin roles │
│ □ Custom RBAC roles scoped to resource group │
│ □ No Owner role assigned at subscription level │
│ □ Service principals use certificates (not secrets) │
│ □ Access reviews configured for privileged roles │
│ │
│ GCP │
│ □ No primitive roles (Owner/Editor) on projects │
│ □ Service accounts: no user-managed keys │
│ □ Workload Identity for GKE (no mounted SA keys) │
│ □ IAM Recommender suggestions reviewed quarterly │
│ □ Domain-restricted sharing enforced via org policy │
│ □ Service account impersonation audited │
│ │
│ AUDIT COMMANDS (AWS) │
│ aws iam get-credential-report --output text | head -5 │
│ aws iam list-users --query 'Users[?PasswordLastUsed==null]' │
│ aws iam list-access-keys --user-name X │
│ aws accessanalyzer list-findings --analyzer-arn X │
└──────────────────────────────────────────────────────────────┘
Phase 2: Storage Security
┌──────────────────────────────────────────────────────────────┐
│ PHASE 2: STORAGE SECURITY │
│ │
│ AWS S3 │
│ □ Account-level Block Public Access enabled │
│ □ Bucket-level Block Public Access on every bucket │
│ □ No bucket policies with Principal: * │
│ □ SSE-KMS encryption (not SSE-S3 or no encryption) │
│ □ Versioning enabled on all buckets with data │
│ □ MFA Delete enabled on critical buckets │
│ □ Access logging enabled → separate logging bucket │
│ □ Lifecycle rules: transition to Glacier, expire old │
│ □ Object Lock for compliance/audit buckets │
│ □ No static website hosting unless through CloudFront │
│ □ CORS policy minimized (not wildcard origins) │
│ □ Presigned URLs have short TTL (< 1 hour) │
│ │
│ AZURE BLOB STORAGE │
│ □ Storage account: public access disabled │
│ □ Encryption: Microsoft-managed or customer-managed key │
│ □ Soft delete enabled (14+ day retention) │
│ □ Private endpoints for all storage accounts │
│ □ Shared Access Signatures: short expiry, IP-restricted │
│ □ Storage firewall: deny all, allow specific VNets │
│ │
│ GCP CLOUD STORAGE │
│ □ Uniform bucket-level access (no per-object ACLs) │
│ □ No allUsers or allAuthenticatedUsers permissions │
│ □ Customer-managed encryption keys (CMEK) via Cloud KMS │
│ □ Object versioning enabled │
│ □ Retention policies on compliance buckets │
│ □ VPC Service Controls perimeter around sensitive buckets │
│ │
│ AUDIT COMMANDS (AWS) │
│ aws s3api list-buckets | jq '.Buckets[].Name' │
│ aws s3api get-bucket-encryption --bucket X │
│ aws s3api get-public-access-block --bucket X │
│ aws s3api get-bucket-versioning --bucket X │
│ aws s3api get-bucket-logging --bucket X │
│ aws s3api get-bucket-policy --bucket X 2>/dev/null │
└──────────────────────────────────────────────────────────────┘
Phase 3: Database Security
┌──────────────────────────────────────────────────────────────┐
│ PHASE 3: DATABASE SECURITY │
│ │
│ AWS RDS / AURORA │
│ □ No public accessibility (PubliclyAccessible: false) │
│ □ Encryption at rest enabled with CMK (not default key) │
│ □ SSL/TLS enforced (rds.force_ssl parameter = 1) │
│ □ Deployed in private subnets only │
│ □ Security group allows only application SG (not 0.0.0.0/0)│
│ □ IAM database authentication enabled (where supported) │
│ □ Automated backups enabled (7+ day retention) │
│ □ Backup encryption matches instance encryption │
│ □ Multi-AZ for production (HA, not just DR) │
│ □ Enhanced monitoring enabled │
│ □ Performance Insights enabled (encrypted) │
│ □ Minor version auto-upgrade enabled │
│ □ Deletion protection enabled on production │
│ □ Database activity streams (for audit logging) │
│ □ No master credentials in code — use Secrets Manager │
│ │
│ AZURE SQL / COSMOS DB │
│ □ Transparent Data Encryption (TDE) with CMK │
│ □ Private endpoint (no public endpoint) │
│ □ Entra ID authentication (not SQL auth alone) │
│ □ Advanced Threat Protection enabled │
│ □ Auditing enabled to Log Analytics or Storage │
│ □ Firewall: deny all public access │
│ │
│ GCP CLOUD SQL │
│ □ No public IP assigned │
│ □ Private Services Access (VPC peering) │
│ □ Encryption with CMEK │
│ □ SSL enforced (require_ssl flag) │
│ □ Automated backups with PITR │
│ □ Database flags: log_connections, log_disconnections on │
│ │
│ AUDIT COMMANDS (AWS) │
│ aws rds describe-db-instances --query \ │
│ 'DBInstances[].[DBInstanceIdentifier,PubliclyAccessible, │
│ StorageEncrypted,MultiAZ]' --output table │
│ aws rds describe-db-instances --query \ │
│ 'DBInstances[?PubliclyAccessible==`true`]' │
└──────────────────────────────────────────────────────────────┘
Phase 4: Network Security
┌──────────────────────────────────────────────────────────────┐
│ PHASE 4: NETWORK SECURITY │
│ │
│ VPC ARCHITECTURE │
│ □ Separate VPCs for production and non-production │
│ □ Private subnets for compute and data tiers │
│ □ Public subnets only for ALB/NLB (no direct EC2) │
│ □ NAT Gateway for outbound from private subnets │
│ □ VPC endpoints for AWS services (S3, ECR, SQS, SSM) │
│ □ VPC flow logs enabled on all VPCs │
│ │
│ SECURITY GROUPS │
│ □ No inbound rules with 0.0.0.0/0 (except ALB 80/443) │
│ □ No inbound rules with ::/0 │
│ □ Reference other security groups (not IP ranges) │
│ □ No rules allowing all ports (port range 0-65535) │
│ □ Outbound restricted where possible (not 0.0.0.0/0 all) │
│ □ Unused security groups identified and removed │
│ □ Default VPC security group has no rules │
│ │
│ NACLs │
│ □ Deny rules for known-bad IP ranges │
│ □ Explicit allow rules match security group intent │
│ □ Default NACL does not allow all traffic │
│ │
│ AZURE NSGs │
│ □ No Allow * for source or destination │
│ □ NSG flow logs enabled │
│ □ Application Security Groups used for grouping │
│ □ Private Link for PaaS services (SQL, Storage, KV) │
│ │
│ GCP FIREWALL │
│ □ Default-allow-internal reviewed (restrict if possible) │
│ □ No 0.0.0.0/0 source on allow rules │
│ □ VPC Service Controls for sensitive projects │
│ □ Firewall rules logged │
│ │
│ AUDIT COMMANDS (AWS) │
│ # Find security groups with 0.0.0.0/0 ingress │
│ aws ec2 describe-security-groups --query \ │
│ 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp== │
│ `0.0.0.0/0`]]].[GroupId,GroupName]' --output table │
│ # Check VPC flow logs │
│ aws ec2 describe-flow-logs --query \ │
│ 'FlowLogs[].[FlowLogId,ResourceId,LogStatus]' │
└──────────────────────────────────────────────────────────────┘
Phase 5: Encryption & Key Management
┌──────────────────────────────────────────────────────────────┐
│ PHASE 5: ENCRYPTION & KEY MANAGEMENT │
│ │
│ AWS KMS │
│ □ CMKs used for all data-at-rest (not aws/service keys) │
│ □ Key rotation enabled (automatic annual rotation) │
│ □ Key policy follows least privilege: │
│ - Key administrators cannot encrypt/decrypt │
│ - Key users cannot administer the key │
│ - Root account is key admin (break-glass) │
│ □ Grants scoped to specific operations and principals │
│ □ Alias naming convention: alias/{project}-{env}-{purpose} │
│ □ Key deletion has 30-day waiting period configured │
│ □ No disabled or pending-deletion keys still referenced │
│ │
│ ENCRYPTION AT REST CHECKLIST │
│ □ EBS volumes: encrypted with CMK │
│ □ EBS snapshots: encrypted (follows volume encryption) │
│ □ S3 buckets: SSE-KMS with CMK │
│ □ RDS instances: encrypted with CMK │
│ □ RDS snapshots: encrypted (follows instance encryption) │
│ □ ElastiCache: at-rest encryption with CMK │
│ □ SQS queues: SSE-KMS │
│ □ SNS topics: SSE-KMS │
│ □ CloudWatch Logs: encrypted with CMK │
│ □ DynamoDB tables: encrypted with CMK │
│ □ EFS: encrypted with CMK │
│ □ Secrets Manager: encrypted with CMK │
│ │
│ ENCRYPTION IN TRANSIT │
│ □ ALB/NLB: TLS 1.2+ only (no TLS 1.0/1.1) │
│ □ ACM certificates: auto-renewal enabled │
│ □ RDS: SSL enforced (rds.force_ssl = 1) │
│ □ ElastiCache: in-transit encryption enabled │
│ □ S3: Bucket policy denies non-SSL requests │
│ □ Internal services: mTLS or at minimum TLS │
│ │
│ AZURE KEY VAULT │
│ □ Soft delete + purge protection enabled │
│ □ Access policies: least privilege per principal │
│ □ Key rotation policy defined │
│ □ Private endpoint (no public access) │
│ □ Diagnostic logging to Log Analytics │
│ │
│ GCP CLOUD KMS │
│ □ Key rings scoped to project and region │
│ □ IAM bindings: separate encrypt/decrypt permissions │
│ □ Rotation period set (90 days recommended) │
│ □ CMEK applied to all storage and compute resources │
└──────────────────────────────────────────────────────────────┘
Phase 6: Logging & Monitoring
┌──────────────────────────────────────────────────────────────┐
│ PHASE 6: LOGGING & MONITORING │
│ │
│ AWS CLOUDTRAIL │
│ □ Enabled in ALL regions (not just primary) │
│ □ Multi-region trail configured │
│ □ Management events: Read + Write │
│ □ Data events: S3 object-level + Lambda invocations │
│ □ Log file validation enabled (integrity checking) │
│ □ Encrypted with CMK │
│ □ Delivered to S3 with Object Lock (immutable) │
│ □ Delivered to CloudWatch Logs for real-time alerting │
│ □ S3 bucket: no public access, deny deletes via policy │
│ □ Separate logging account (cross-account delivery) │
│ │
│ AWS GUARDDUTY │
│ □ Enabled in all regions │
│ □ S3 protection enabled │
│ □ EKS protection enabled (if using EKS) │
│ □ Malware protection enabled │
│ □ Findings exported to Security Hub │
│ □ High/Critical findings trigger SNS alerts │
│ │
│ AWS CONFIG │
│ □ Recording enabled in all regions │
│ □ Config rules for CIS Benchmark checks │
│ □ Conformance packs deployed │
│ □ Remediation actions configured for critical rules │
│ │
│ AWS SECURITY HUB │
│ □ Enabled with CIS AWS Foundations Benchmark │
│ □ AWS Foundational Security Best Practices enabled │
│ □ Aggregated across accounts (if multi-account) │
│ □ Automated response for critical findings │
│ │
│ CLOUDWATCH ALARMS (minimum set) │
│ □ Root account login │
│ □ Console login without MFA │
│ □ IAM policy changes │
│ □ CloudTrail configuration changes │
│ □ S3 bucket policy changes │
│ □ Security group changes │
│ □ NACL changes │
│ □ Network gateway changes │
│ □ VPC changes │
│ □ Failed console logins (> 3 in 5 minutes) │
│ │
│ AZURE EQUIVALENT │
│ □ Azure Monitor + Log Analytics workspace │
│ □ Defender for Cloud: standard tier on all resources │
│ □ Azure Sentinel for SIEM │
│ □ Diagnostic settings on all resources → Log Analytics │
│ │
│ GCP EQUIVALENT │
│ □ Cloud Audit Logs: Admin Activity + Data Access │
│ □ Security Command Center: Premium tier │
│ □ Log sinks to separate project for immutability │
│ □ Alerting policies for critical IAM and network changes │
│ │
│ AUDIT COMMANDS (AWS) │
│ aws cloudtrail describe-trails --output table │
│ aws cloudtrail get-trail-status --name X │
│ aws guardduty list-detectors │
│ aws securityhub describe-hub │
│ aws configservice describe-configuration-recorders │
└──────────────────────────────────────────────────────────────┘
Phase 7: IaC Security Scanning
┌──────────────────────────────────────────────────────────────┐
│ PHASE 7: INFRASTRUCTURE AS CODE SCANNING │
│ │
│ TERRAFORM (tfsec / checkov / trivy) │
│ │
│ CI PIPELINE INTEGRATION │
│ │
│ PR opened │
│ │ │
│ ▼ │
│ terraform fmt -check (formatting) │
│ │ │
│ ▼ │
│ terraform validate (syntax) │
│ │ │
│ ▼ │
│ tfsec . --format json (security scan) │
│ │ │
│ ▼ │
│ checkov -d . --framework terraform (compliance scan) │
│ │ │
│ ▼ │
│ terraform plan → PR comment with diff │
│ │ │
│ ▼ │
│ PASS? ─── YES ──→ Allow merge │
│ │ │
│ NO ──→ Block merge, require fix │
│ │
│ CRITICAL CHECKS (block PR on failure) │
│ □ No public S3 buckets │
│ □ No unencrypted storage (EBS, S3, RDS) │
│ □ No security groups with 0.0.0.0/0 ingress │
│ □ No IAM policies with * Resource │
│ □ No hardcoded secrets in tf files │
│ □ CloudTrail enabled │
│ □ RDS not publicly accessible │
│ □ KMS key rotation enabled │
│ │
│ CHECKOV COMMAND │
│ checkov -d . \ │
│ --framework terraform \ │
│ --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_21,CKV_AWS_23 \ │
│ --compact \ │
│ --output cli │
│ │
│ TFSEC COMMAND │
│ tfsec . --format lovely --exclude-downloaded-modules │
│ │
│ DRIFT DETECTION │
│ □ Run terraform plan daily to detect manual changes │
│ □ Alert on any drift detected │
│ □ Require drift resolution before next apply │
│ □ Tag all resources: ManagedBy=terraform │
└──────────────────────────────────────────────────────────────┘
Phase 8: CIS Benchmark Compliance Mapping
CIS AWS Foundations Benchmark — Key Controls
┌────────────────────────────────────────────────────────────────────────┐
│ CIS AWS Foundations Benchmark v3.0 — Key Controls │
│ │
│ Section │ Control │ Level │ Status │
│ ────────────────────────────────────────────────────────────────── │
│ 1.1 │ Maintain current contact details │ L1 │ □ Pass / Fail │
│ 1.4 │ Root account has no access keys │ L1 │ □ Pass / Fail │
│ 1.5 │ Root account has MFA enabled │ L1 │ □ Pass / Fail │
│ 1.6 │ Root account has hardware MFA │ L2 │ □ Pass / Fail │
│ 1.8 │ IAM password policy (14+ chars) │ L1 │ □ Pass / Fail │
│ 1.10 │ MFA enabled for console users │ L1 │ □ Pass / Fail │
│ 1.12 │ No access keys at setup │ L1 │ □ Pass / Fail │
│ 1.13 │ One active access key per user │ L1 │ □ Pass / Fail │
│ 1.14 │ Access keys rotated <= 90 days │ L1 │ □ Pass / Fail │
│ 1.16 │ No inline policies on users │ L1 │ □ Pass / Fail │
│ 1.17 │ IAM policies attached to groups │ L1 │ □ Pass / Fail │
│ 1.20 │ Support role for AWS Support │ L1 │ □ Pass / Fail │
│ 1.22 │ No * in IAM policy statements │ L1 │ □ Pass / Fail │
│ 2.1.1 │ S3 deny non-SSL requests │ L1 │ □ Pass / Fail │
│ 2.1.2 │ S3 MFA Delete on sensitive buckets│ L2 │ □ Pass / Fail │
│ 2.1.4 │ S3 Block Public Access (account) │ L1 │ □ Pass / Fail │
│ 2.2.1 │ EBS encryption by default │ L1 │ □ Pass / Fail │
│ 2.3.1 │ RDS encryption at rest │ L1 │ □ Pass / Fail │
│ 2.3.2 │ RDS auto minor version upgrade │ L1 │ □ Pass / Fail │
│ 2.3.3 │ RDS not publicly accessible │ L1 │ □ Pass / Fail │
│ 3.1 │ CloudTrail enabled all regions │ L1 │ □ Pass / Fail │
│ 3.2 │ CloudTrail log file validation │ L1 │ □ Pass / Fail │
│ 3.3 │ CloudTrail S3 bucket not public │ L1 │ □ Pass / Fail │
│ 3.4 │ CloudTrail → CloudWatch Logs │ L1 │ □ Pass / Fail │
│ 3.6 │ S3 access logging on CT bucket │ L1 │ □ Pass / Fail │
│ 3.7 │ CloudTrail encrypted with CMK │ L2 │ □ Pass / Fail │
│ 3.9 │ VPC flow logs enabled │ L2 │ □ Pass / Fail │
│ 4.1 │ Filter: unauthorized API calls │ L1 │ □ Pass / Fail │
│ 4.3 │ Filter: root account usage │ L1 │ □ Pass / Fail │
│ 4.4 │ Filter: IAM policy changes │ L1 │ □ Pass / Fail │
│ 4.5 │ Filter: CloudTrail config changes │ L1 │ □ Pass / Fail │
│ 4.6 │ Filter: console auth failures │ L1 │ □ Pass / Fail │
│ 4.8 │ Filter: S3 bucket policy changes │ L1 │ □ Pass / Fail │
│ 4.12 │ Filter: network gateway changes │ L1 │ □ Pass / Fail │
│ 4.14 │ Filter: VPC changes │ L1 │ □ Pass / Fail │
│ 5.1 │ No 0.0.0.0/0 to port 22 (SSH) │ L1 │ □ Pass / Fail │
│ 5.2 │ No 0.0.0.0/0 to port 3389 (RDP) │ L1 │ □ Pass / Fail │
│ 5.3 │ Default SG restricts all traffic │ L1 │ □ Pass / Fail │
│ 5.6 │ VPC peering least-access routing │ L2 │ □ Pass / Fail │
└────────────────────────────────────────────────────────────────────────┘
Compliance Framework Cross-Reference
┌──────────────────────────────────────────────────────────────────┐
│ Control Area │ SOC 2 │ ISO 27001 │ HIPAA │ FedRAMP │
│ ───────────────────────────────────────────────────────────── │
│ Access Control │ CC6.1-3 │ A.9 │ 164.312│ AC-* │
│ Encryption at rest │ CC6.1 │ A.10.1 │ 164.312│ SC-28 │
│ Encryption transit │ CC6.7 │ A.10.1 │ 164.312│ SC-8 │
│ Audit Logging │ CC7.2 │ A.12.4 │ 164.312│ AU-* │
│ Network Security │ CC6.6 │ A.13 │ 164.312│ SC-7 │
│ Key Management │ CC6.1 │ A.10.1 │ 164.312│ SC-12 │
│ Incident Detection │ CC7.2-3 │ A.16 │ 164.308│ IR-* │
│ Config Management │ CC8.1 │ A.12.5 │ 164.312│ CM-* │
│ Vulnerability Mgmt │ CC7.1 │ A.12.6 │ 164.308│ RA-5 │
│ Backup / Recovery │ CC7.5 │ A.12.3 │ 164.308│ CP-9 │
│ Change Management │ CC8.1 │ A.12.1 │ 164.312│ CM-3 │
└──────────────────────────────────────────────────────────────────┘
Top 20 Cloud Misconfigurations
┌────────────────────────────────────────────────────────────────────────┐
│ # │ Misconfiguration │ Sev │ Impact │ Fix │
│ ───────────────────────────────────────────────────────────────────── │
│ 1 │ S3 bucket public │ CRIT │ Data breach │ Block Public │
│ │ │ │ │ Access │
│ 2 │ RDS publicly accessible │ CRIT │ DB exposure │ Private sub- │
│ │ │ │ │ nets only │
│ 3 │ SG ingress 0.0.0.0/0 │ CRIT │ Unrestricted │ Scope to │
│ │ on SSH/RDP │ │ remote access │ bastion SG │
│ 4 │ IAM role with *:* │ CRIT │ Full account │ Enumerate │
│ │ │ │ compromise │ actions │
│ 5 │ No CloudTrail │ CRIT │ No forensics │ Enable all │
│ │ │ │ │ regions │
│ 6 │ Root access keys exist │ HIGH │ Root takeover │ Delete keys, │
│ │ │ │ │ use IAM │
│ 7 │ No MFA on root │ HIGH │ Root takeover │ Hardware MFA │
│ 8 │ Unencrypted EBS │ HIGH │ Data at rest │ Default EBS │
│ │ │ │ exposure │ encryption │
│ 9 │ Unencrypted RDS │ HIGH │ Data at rest │ Enable CMK │
│ │ │ │ exposure │ encryption │
│ 10 │ IAM access keys > 90d │ HIGH │ Stale creds │ Rotate/delete│
│ 11 │ No VPC flow logs │ HIGH │ No network │ Enable all │
│ │ │ │ visibility │ VPCs │
│ 12 │ Default VPC in use │ MED │ Flat network │ Delete or │
│ │ │ │ │ harden │
│ 13 │ AWS-managed keys (not CMK)│ MED │ No key control │ Switch to │
│ │ │ │ │ CMK │
│ 14 │ No GuardDuty │ MED │ No threat │ Enable all │
│ │ │ │ detection │ regions │
│ 15 │ IMDSv1 enabled │ MED │ SSRF → cred │ Require │
│ │ │ │ theft │ IMDSv2 │
│ 16 │ SG with all ports open │ MED │ Lateral move │ Restrict │
│ │ │ │ │ to needed │
│ 17 │ No S3 access logging │ MED │ No audit trail │ Enable to │
│ │ │ │ │ log bucket │
│ 18 │ Inline IAM policies │ LOW │ Hard to audit │ Managed │
│ │ │ │ │ policies │
│ 19 │ No resource tags │ LOW │ No attribution │ Enforce tag │
│ │ │ │ │ policy │
│ 20 │ CloudTrail no validation │ LOW │ Tamper risk │ Enable file │
│ │ │ │ │ validation │
└────────────────────────────────────────────────────────────────────────┘
Cloud Security Report Template
## Cloud Security Posture Report
### Scope
- Provider: [AWS / Azure / GCP]
- Account(s): [account ID(s)]
- Region(s): [regions audited]
- Date: [date]
- Auditor: [name]
- Benchmark: CIS [provider] Foundations Benchmark v[X.X]
### Summary
| Severity | Count |
|----------|-------|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |
| Pass | X |
### CIS Benchmark Score
- Level 1: X/Y controls passing (XX%)
- Level 2: X/Y controls passing (XX%)
### Critical Findings
1. [Category] — Short description
- **Resource**: [ARN or resource ID]
- **CIS Control**: [control number]
- **Risk**: What can an attacker exploit
- **Evidence**: CLI command output or console screenshot reference
- **Remediation**: Exact steps (IaC preferred)
- **Verified**: [ ] Fixed and re-tested
### High Findings
[same format]
### Medium Findings
[same format]
### Low Findings
[same format]
### What Looks Good
[list of controls that are correctly implemented]
### Recommendations
[prioritized remediation plan with timeline]
Cloud Security Checklist — Comprehensive
AWS (50 items)
IDENTITY & ACCESS
□ 01. Root MFA — hardware key
□ 02. Root has no access keys
□ 03. IAM password policy — 14+ chars, rotation
□ 04. MFA on all IAM users with console access
□ 05. No access keys older than 90 days
□ 06. No unused IAM users (90+ days inactive)
□ 07. No inline policies on users
□ 08. IAM roles — no * in Action or Resource
□ 09. Permission boundaries on delegated roles
□ 10. SCPs deny leave-org, disable-CT, delete-flowlogs
□ 11. IAM Access Analyzer enabled
□ 12. Cross-account roles use ExternalId
□ 13. OIDC for CI/CD (no long-lived keys)
STORAGE
□ 14. Account-level S3 Block Public Access
□ 15. Bucket-level Block Public Access (every bucket)
□ 16. S3 SSE-KMS encryption (CMK)
□ 17. S3 versioning enabled
□ 18. S3 access logging enabled
□ 19. S3 bucket policy denies non-SSL
□ 20. S3 Object Lock on audit/compliance buckets
DATABASE
□ 21. RDS not publicly accessible
□ 22. RDS encryption at rest (CMK)
□ 23. RDS SSL enforced
□ 24. RDS in private subnets
□ 25. RDS automated backups (7+ day retention)
□ 26. RDS deletion protection (production)
□ 27. RDS minor auto-upgrade enabled
□ 28. ElastiCache encryption at rest + in transit
NETWORK
□ 29. No SG rules with 0.0.0.0/0 ingress (except ALB)
□ 30. Default SG restricts all traffic
□ 31. VPC flow logs on all VPCs
□ 32. VPC endpoints for S3, ECR, SQS, SSM
□ 33. Private subnets for compute + data
□ 34. No default VPC in use
□ 35. NACLs reviewed
ENCRYPTION
□ 36. EBS default encryption enabled (CMK)
□ 37. KMS key rotation enabled
□ 38. KMS key policies — least privilege
□ 39. TLS 1.2+ on all ALBs
□ 40. ACM certificates auto-renewing
LOGGING
□ 41. CloudTrail — all regions, mgmt + data events
□ 42. CloudTrail — log file validation
□ 43. CloudTrail — encrypted with CMK
□ 44. CloudTrail — S3 bucket not public, no deletes
□ 45. GuardDuty enabled all regions
□ 46. Config Rules recording all regions
□ 47. Security Hub enabled with CIS benchmark
MONITORING
□ 48. Alarm: root login
□ 49. Alarm: IAM policy changes
□ 50. Alarm: SG / NACL / VPC changes
Tips for Best Results
- Start with the blast radius — audit public-facing resources first (S3, RDS, security groups). A misconfigured S3 bucket or public database is the fastest path to a breach.
- Use the provider's own tools — AWS Security Hub + Config Rules, Azure Defender, GCP Security Command Center. They catch 80% of misconfigurations automatically.
- Map findings to CIS controls — every finding should reference a specific CIS benchmark control number. This makes remediation actionable and audit-ready.
- Run IaC scans in CI, not just locally — checkov and tfsec should block PRs with critical findings. Manual scans get skipped; automated ones do not.
- Check what is NOT there — missing CloudTrail, missing flow logs, missing encryption are harder to spot than broken configurations. Audit for absence, not just presence.
- Separate the audit account — CloudTrail logs and Config snapshots should go to a separate AWS account that production admins cannot access. This is CIS Level 2 and every compliance framework requires it.
- Validate the data plane, not just the control plane — a security group may look correct in Terraform, but check the actual AWS state for drift. Run
terraform plan and compare.
- Document exceptions — some resources legitimately need public access (static website hosting behind CloudFront). Document every exception with a justification, approval, and compensating controls.
