| name | aws-security-scanner |
| description | AWS security configuration scanning and hardening using Prowler, Security Hub, and AWS Config |
| allowed-tools | ["Bash","Read","Write","Glob","Grep","WebFetch"] |
AWS Security Scanner Skill
Purpose
Automated AWS security configuration scanning and hardening to identify misconfigurations, compliance violations, and security risks across AWS accounts and organizations.
Capabilities
Prowler Security Assessments
- Run comprehensive Prowler security scans
- Execute CIS AWS Foundations Benchmark checks
- Run AWS Well-Architected security pillar assessments
- Check PCI DSS, HIPAA, GDPR compliance
- Generate multi-format reports (HTML, CSV, JSON)
IAM Security Analysis
- Analyze IAM policies for over-permissive access
- Check for unused credentials and access keys
- Identify IAM users without MFA
- Review cross-account access configurations
- Detect privilege escalation paths
- Analyze service control policies (SCPs)
S3 Bucket Security
- Identify publicly accessible buckets
- Check bucket encryption configurations
- Review bucket policies and ACLs
- Verify access logging enabled
- Check for sensitive data exposure
- Validate versioning and replication
Network Security Analysis
- Review security group configurations
- Analyze Network ACLs
- Check VPC flow log enablement
- Identify public-facing resources
- Validate VPC endpoint configurations
- Check for overly permissive rules
Encryption Verification
- Verify EBS volume encryption
- Check RDS encryption settings
- Validate S3 encryption configurations
- Review KMS key policies
- Check secrets manager configurations
- Verify certificate validity
Logging and Monitoring
- Validate CloudTrail configuration
- Check CloudWatch log retention
- Verify GuardDuty enablement
- Review Security Hub findings
- Check Config rule compliance
- Validate alarm configurations
Compliance Mapping
- Map findings to CIS Benchmarks
- Generate SOC 2 evidence
- Track PCI DSS compliance
- Document HIPAA controls
- Map to NIST frameworks
AWS Services Covered
| Category | Services |
|---|
| Identity | IAM, SSO, Organizations |
| Compute | EC2, Lambda, ECS, EKS |
| Storage | S3, EBS, EFS, Glacier |
| Database | RDS, DynamoDB, Redshift |
| Network | VPC, CloudFront, Route53 |
| Security | Security Hub, GuardDuty, KMS |
| Monitoring | CloudTrail, CloudWatch, Config |
Integrations
- Prowler: Open-source AWS security tool
- AWS Security Hub: Centralized security findings
- AWS Config: Configuration compliance
- AWS CloudTrail: API activity logging
- AWS GuardDuty: Threat detection
- AWS IAM Access Analyzer: Access analysis
Target Processes
- Cloud Security Architecture Review
- Compliance Monitoring
- Security Posture Assessment
- AWS Account Hardening
Input Schema
{
"type": "object",
"properties": {
"scanType": {
"type": "string",
"enum": ["full", "cis", "pci", "hipaa", "gdpr", "custom"],
"description": "Type of security scan"
},
"awsAccounts": {
"type": "array",
"items": { "type": "string" },
"description": "AWS account IDs to scan"
},
"regions":
Output Schema
{
"type": "object",
"properties": {
"scanId": {
"type": "string"
},
"scanTimestamp": {
"type": "string",
"format": "date-time"
},
"accountsScanned": {
"type": "array"
},
"regionsScanned": {
"type": "array"
},
"summary": {
"type": "object",
"properties": {
"totalChecks": { "type"
Usage Example
skill: {
name: 'aws-security-scanner',
context: {
scanType: 'cis',
awsAccounts: ['123456789012'],
regions: ['us-east-1', 'us-west-2'],
complianceFrameworks: ['CIS', 'SOC2'],
severityThreshold: 'medium'
}
}
