checking-infrastructure-compliance

name	checking-infrastructure-compliance
description	Execute use when you need to work with compliance checking. This skill provides compliance monitoring and validation with comprehensive guidance and automation. Trigger with phrases like "check compliance", "validate policies", or "audit compliance".
allowed-tools	Read, Write, Edit, Grep, Glob, Bash(cmd:*)
version	1.26.0
author	Jeremy Longshore <[e-mail]>
license	MIT
tags	["devops","monitoring","compliance","audit"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Checking Infrastructure Compliance

Overview

Audit infrastructure configurations against compliance frameworks (CIS Benchmarks, SOC 2, HIPAA, PCI-DSS, GDPR) using policy-as-code tools like Open Policy Agent (OPA), Checkov, and tfsec. Generate compliance reports, identify violations, and produce remediation plans for Terraform, Kubernetes, and cloud provider configurations.

Prerequisites

• Policy-as-code tool installed: checkov, tfsec, opa, or kube-bench
• Infrastructure-as-code files (Terraform, CloudFormation, Kubernetes manifests) in the project
• Cloud provider CLI authenticated with read access to resources
• Compliance framework requirements documented (CIS, SOC 2, HIPAA, PCI-DSS)
• jq for parsing JSON policy outputs

Instructions

1. Identify the applicable compliance framework(s) based on industry and data classification
2. Scan Terraform files with checkov -d . or tfsec . to detect misconfigurations
3. Scan Kubernetes manifests for security issues: missing resource limits, privileged containers, missing network policies
4. Validate IAM policies for least-privilege violations using cloud-native tools (aws iam access-analyzer)
5. Check encryption at rest and in transit: verify S3 bucket encryption, database TLS, and EBS volume encryption
6. Audit logging configurations: confirm CloudTrail/Cloud Audit Logs are enabled and sent to immutable storage
7. Generate a compliance report mapping each finding to the relevant control (e.g., CIS AWS 2.1.1)
8. Produce remediation Terraform/YAML patches for each violation with severity ranking (Critical, High, Medium, Low)
9. Set up CI/CD integration so compliance checks block merges on Critical/High violations

Output

• Compliance scan results in JSON/SARIF format for CI integration
• Markdown compliance report with control mappings and pass/fail status
• Remediation code patches (Terraform diffs, Kubernetes manifest updates)
• OPA/Rego policy files for custom organizational rules
• CI/CD pipeline step configuration for automated compliance gating

Error Handling

Error	Cause	Solution
checkov: no Terraform files found	Scanner run from wrong directory