aws-cloudtrail-report-packager

name	aws-cloudtrail-report-packager
description	Package AWS CloudTrail baselines, evidence packs, detection specs, and business triage into customer-facing reports. Use when producing Markdown or PDF-ready reports that need executive summaries, finding cards, remediation roadmaps, evidence appendices, reproduction commands, or Transilience-style CloudTrail investigation and business-baseline documents.

AWS CloudTrail Report Packager

Use this skill at the end of a CloudTrail analysis workflow.

Quick Start

python3 ../../skills/aws/cloudtrail/report-packager/scripts/package_markdown_report.py \
  --customer "Customer" \
  --baseline baseline.json \
  --evidence-pack evidence_pack \
  --triage triage_findings.md \
  --detection-specs cloudtrail_detection_specs.json \
  --output cloudtrail_report.md

Report Requirements

• Lead with business impact and residual risk.
• Include evidence volume and source coverage.
• Include a remediation roadmap with control owner language.
• Include an appendix that points to raw evidence and reproduction commands.
• Preserve uncertainty: “likely sanctioned,” “requires ticket verification,” and “not enough evidence” are valid conclusions.
• Do not paste large raw JSON into the report; link to the evidence files and include compact examples only.

PDF

If the user asks for a PDF, produce Markdown first and then use an explicit public renderer or downstream documentation pipeline so the content remains reviewable.