This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
When performing initial security audits of cloud environments against industry-standard benchmarks
When preparing for SOC 2, ISO 27001, or regulatory audits that reference CIS controls
When establishing a measurable security baseline for new cloud accounts or subscriptions
When tracking compliance improvement over time with periodic reassessment
When evaluating the security posture of acquired or inherited cloud environments
Do not use for runtime threat detection (see detecting-cloud-threats-with-guardduty), for application-level security testing (see conducting-cloud-penetration-testing), or for compliance frameworks not based on CIS (refer to specific regulatory skill files).
Detection Gaps & Validation
Scope gaps silently pass: a single-region Prowler/ScoutSuite run misses resources in other regions — global resources aside, scan all regions (don't pin --region). In AWS Organizations, member accounts need a working assumed role; a role lacking permissions yields ERROR/MANUAL, notFAIL, so failures hide as "not checked."
MANUAL/INFO ≠ PASS: many CIS items (e.g., AWS 1.1 contact details, support role, several monitoring controls) are manual-attestation and tools mark them MANUAL. Counting those as passing inflates the score. Tally FAIL/MANUAL/ERROR/INFO separately.
Profile and version drift: confirm you ran the right benchmark (AWS v5.0 / Azure v4.0 / GCP v4.0) and the right Level (L1 vs L2). A v3 ruleset will miss newer controls and mis-map IDs.
Security Hub "enabled" vs working:batch-enable-standards only subscribes — controls can still be disabled or lack the AWS Config recorder they depend on, producing no results.
Validate before reporting: re-run with --status FAIL and reconcile failed-resource counts against ground truth (e.g., compare reported unencrypted buckets to aws s3api list-buckets + per-bucket get-bucket-encryption); confirm AWS Config recorder is on in every region the benchmark assumes.
Prowler, ScoutSuite, or cloud-native CSPM tools installed and configured
Understanding of CIS benchmark structure: sections, controls, profiles (Level 1 and Level 2)
Remediation access for implementing fixes (separate from audit credentials)
Workflow
Step 1: Select Appropriate CIS Benchmark Version
Choose the correct benchmark version for each cloud provider. Current versions as of 2025 include CIS AWS Foundations Benchmark v5.0, CIS Azure Foundations Benchmark v4.0, and CIS GCP Foundations Benchmark v4.0.
Step 3: Interpret Results and Prioritize Remediation
Analyze audit results by section and severity. Prioritize Level 1 controls first as they represent fundamental security hygiene, then address Level 2 controls for defense in depth.
Prescriptive security configuration guidelines developed by the Center for Internet Security through community consensus
Level 1 Profile
Practical security controls implementable without significant performance or functionality impact, representing security hygiene
Level 2 Profile
Defense-in-depth controls that may restrict functionality and require careful planning before implementation
Foundations Benchmark
CIS benchmark specifically for cloud providers covering IAM, logging, monitoring, networking, and storage security
Control ID
Unique numerical identifier for each CIS recommendation (e.g., 1.4 for root access key checks, 2.1.1 for S3 encryption)
Compliance Score
Percentage of CIS controls in a passing state, tracked over time to measure security posture improvement
Automated Assessment
Tool-driven evaluation of CIS controls using cloud provider APIs to check resource configurations against benchmark requirements
Remediation Runbook
Documented step-by-step procedure for fixing a specific failed CIS control, including pre-checks and validation
Tools & Systems
Prowler: Open-source cloud security tool performing 300+ checks including CIS benchmark assessments for AWS, Azure, and GCP
ScoutSuite: Multi-cloud security auditing tool with CIS benchmark rule sets generating HTML reports
AWS Security Hub: Native AWS service supporting CIS AWS Foundations Benchmark as a security standard
Azure Policy: Governance service with built-in CIS benchmark policy initiatives for automated compliance monitoring
GCP Security Command Center: Native GCP service evaluating configurations against CIS GCP Foundations Benchmark
Common Scenarios
Scenario: Pre-Audit CIS Assessment for SOC 2 Certification
Context: A SaaS company pursuing SOC 2 Type II certification needs to demonstrate cloud security controls aligned to CIS benchmarks. The auditor requires evidence of continuous compliance monitoring across 45 AWS accounts.
Approach:
Run Prowler CIS v5.0 assessment across all 45 accounts to establish the baseline compliance score
Export results to CSV and categorize failures by section (IAM, Logging, Monitoring, Networking)
Map each CIS control to the relevant SOC 2 Trust Services Criteria (CC6.1, CC6.6, CC7.1, etc.)
Remediate all Level 1 control failures within 30 days and Level 2 within 60 days
Enable CIS v5.0 in AWS Security Hub for continuous monitoring and automated drift detection
Generate weekly compliance reports showing improvement trajectory for the auditor
Document exceptions for controls intentionally not implemented with risk acceptance justification
Pitfalls: Remediating controls without testing in a staging environment first can break production workloads. Ignoring Level 2 controls entirely weakens the audit narrative even if they are not strictly required.
Output Format
CIS Benchmark Audit Report
============================
Cloud Provider: AWS
Benchmark Version: CIS AWS Foundations Benchmark v5.0
Accounts Assessed: 45
Assessment Date: 2025-02-23
Tool: Prowler v4.3.0
OVERALL COMPLIANCE SCORE: 74%
COMPLIANCE BY SECTION:
1. Identity and Access Management: 68% (41/60 controls passed)
2. Storage: 82% (28/34 controls passed)
3. Logging: 91% (20/22 controls passed)
4. Monitoring: 55% (18/33 controls passed)
5. Networking: 78% (32/41 controls passed)
TOP FAILED CONTROLS (by affected accounts):
[1.4] Root account has active access keys - 3/45 accounts
[1.5] MFA not enabled for root account - 2/45 accounts
[2.1.1] S3 default encryption not enabled - 12/45 accounts
[3.1] CloudTrail not multi-region - 8/45 accounts
[4.3] No alarm for root account usage - 28/45 accounts
[5.1] VPC flow logs not enabled - 15/45 accounts
[5.4] Security groups allow 0.0.0.0/0 ingress - 22/45 accounts
REMEDIATION PRIORITY:
Critical (Fix within 7 days): Root access keys, missing root MFA
High (Fix within 30 days): S3 encryption, CloudTrail, VPC flow logs
Medium (Fix within 60 days): CloudWatch alarms, security group restrictions
Low (Fix within 90 days): Level 2 controls, informational items
