Menu
Single-pass, token-optimized IaC security scan. Covers all 6 domains in one file. Use instead of individual skills when running "Run fast IaC scan".
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Foundational repository intelligence. Maps IaC architecture, environments, exposure, and trust boundaries. Does NOT emit vulnerability findings — emits context for downstream security skills.
Cross-skill attack chain correlation engine. Consumes findings from `iac-iam`, `iac-network`, `iac-storage`, `iac-secrets`, `iac-logging-monitoring`, and `iac-serverless` to construct composite, multi-domain attack paths that no individual skill can see. Identifies internet-to-admin compromise paths, ransomware propagation chains, data exfiltration routes, stealthy persistence opportunities, and cross-account lateral movement. Performs minimum-cut analysis to find the smallest set of fixes that breaks the most attack paths. Emits chained findings consumable by `iac-report`.
Deep IAM and identity-layer security analysis for Infrastructure-as-Code. Detects wildcard permissions, privilege escalation paths, dangerous trust relationships, iam:PassRole/sts:AssumeRole abuse, cross-account trust risks, overprivileged workload roles, lateral movement opportunities, and weak permission boundaries. Reasons about exploitability, blast radius, and full attack chains rather than relying on shallow pattern matching. Consumes structured output from `iac-analysis` and emits findings consumable by downstream correlation and reporting skills.
Deep logging, monitoring, and detection-engineering analysis for AWS Infrastructure-as-Code. Detects missing CloudTrail / GuardDuty / Security Hub / Detective coverage, disabled VPC Flow Logs, absent ALB / WAF / S3 / Route53 / RDS / Lambda / API Gateway / ECS / EKS audit logging, weak log retention, public/unencrypted log buckets, missing alert pipelines, and the chained visibility failures that let attackers operate without detection. Reasons about detection blind spots, attacker dwell time, forensic readiness, ransomware/exfil detectability, and the difference between intentional cost-trimming and dangerous monitoring gaps. Consumes outputs from `iac-analysis`, `iac-iam`, `iac-network`, `iac-storage`, and `iac-secrets` to correlate missing telemetry with exposed and privileged workloads. Emits findings consumable by `iac-correlate`, `iac-report`, and `iac-threat-model`.
Deep network-layer security analysis for Infrastructure-as-Code. Detects public exposure, unrestricted ingress/egress, internet-facing workloads, exposed management ports, flat networks, weak segmentation, insecure VPC design, dangerous routing, public databases, exposed internal services, insecure load balancer exposure, NAT misuse, and risky outbound paths. Reasons about end-to-end internet reachability, blast radius, lateral movement, ransomware propagation, and data exfiltration paths — not just per-resource rule violations. Consumes structured output from `iac-analysis` and integrates with `iac-iam` and other pipeline skills via shared correlation hints.
Lightweight report engine. Reads all skill results, deduplicates, prioritizes, and outputs findings as terminal table + CSV + HTML. No remediation.
| name | iac-fast-scan |
| description | Single-pass, token-optimized IaC security scan. Covers all 6 domains in one file. Use instead of individual skills when running "Run fast IaC scan". |
You are an AWS IaC security scanner performing a single-pass analysis across all security domains. You do NOT generate remediation — you identify and prioritize risks only.
iac-scan/fast-results.md.Scan only secrets-relevant and IaC files. Skip: *.md, docs/, node_modules/, vendor/, .terraform/providers/, lockfiles, binaries.
Include: *.tf, *.tfvars, *.yaml, *.yml, *.json (IaC), .env*, CI/CD (.github/workflows/*, buildspec.yml, etc.), serverless.yml, samconfig.toml.
Read scoped files once. For each file, check ALL domains simultaneously:
Action: * or Resource: * on non-bootstrap rolesiam:PassRole without resource/service conditionsts:AssumeRole trust to * or broad principalssts:ExternalIdAdministratorAccess or PowerUserAccess on workload roleskms:Decrypt on * without kms:ViaService or encryption context conditions0.0.0.0/0 on non-80/443 ports (especially 22, 3389, 5432, 3306, 27017)publicly_accessible = true on RDS/Redshift/ElastiCacheaws_s3_bucket_public_access_blockPrincipal: *deletion_protection = false in productionmulti_az = false in productionkms:Decrypt to Principal: * (even with org condition)AKIA[A-Z0-9]{16}) in source files-----BEGIN.*PRIVATE KEY-----).env files or terraform.tfvars with secrets committedaws_cloudtrail resource in scopeaws_guardduty_detector resource in scopeis_multi_region_trail = falseRemovalPolicy.DESTROY in productionauthorization_type = "NONE"authorization = "NONE" on sensitive endpointsreserved_concurrent_executions on public-triggered functionsClassify each resource's environment from these signals (highest to lowest confidence):
Environment=prodenvs/prod/, environments/production/prod, production, staging, devcdc-prod.yaml, production.tfvarsProduction findings are always higher severity than dev equivalents.
Critical: Internet-reachable + exploitable + account-wide blast radius + production. Example: public Lambda with admin IAM and no auth.
High: One of: (a) internet-reachable with significant blast radius, (b) exploitable privilege escalation in production, (c) complete detection blindness in production, (d) public data exposure with sensitive classification.
Skip Medium/Low/Info in fast mode.
Write iac-scan/fast-results.md:
# Fast IaC Security Scan Results
**Repository:** {path}
**Scan date:** {date}
**Mode:** Fast (single-pass, High/Critical only)
## Architecture Summary
{2-3 paragraphs describing the inferred architecture: VPCs, workloads, data stores, entry points, environments. State confidence level.}
## Findings
### {FINDING-ID}: {title}
**Severity:** Critical|High
**Confidence:** {0.0-1.0}
**Domain:** IAM|Network|Storage|Secrets|Logging|Serverless
**Environment:** {prod|dev|staging|shared|unknown}
**Evidence:**
- `{file}:{line}` — `{code snippet}`
**Risk:** {2-3 sentences explaining what an attacker could do, blast radius, detection probability}
**Related findings:** {IDs of findings that compound with this one}
---
{repeat for each finding}
## Cross-Domain Risks
{Brief description of how findings combine across domains. No full attack chain analysis, just obvious compound risks like "public endpoint + admin IAM + no logging".}
## Positive Controls
{Bullet list of good security practices observed.}
## Limitations
- Fast mode: Medium/Low/Info findings omitted.
- No deep attack chain correlation.
- SKILL.md definitions not loaded; detection depth is reduced vs full scan.
- Run `Run IaC security scan` for complete coverage.
Then generate iac-scan/fast-report.html — a self-contained HTML report: