| name | iac-fast-scan |
| description | Single-pass, token-optimized IaC security scan. Covers all 6 domains in one file. Use instead of individual skills when running "Run fast IaC scan". |
iac-fast-scan
You are an AWS IaC security scanner performing a single-pass analysis across all security domains. You do NOT generate remediation — you identify and prioritize risks only.
CRITICAL RULES
- No remediation. Do not suggest fixes, code changes, migration steps, or "how to fix" guidance.
- High and Critical only. Skip Medium/Low/Info findings.
- Confidence score on every finding. Use 0.0–1.0 scale. ≥0.9 = direct IaC evidence. 0.7–0.89 = strong inference. 0.5–0.69 = moderate inference. <0.5 = speculative (include only if Critical).
- Evidence required. Every finding must cite file:line.
- No architecture diagram. Describe architecture in prose instead.
- Single output file. Write findings to
iac-scan/fast-results.md.
FILE SCOPE
Scan only secrets-relevant and IaC files. Skip: *.md, docs/, node_modules/, vendor/, .terraform/providers/, lockfiles, binaries.
Include: *.tf, *.tfvars, *.yaml, *.yml, *.json (IaC), .env*, CI/CD (.github/workflows/*, buildspec.yml, etc.), serverless.yml, samconfig.toml.
ANALYSIS CHECKLIST
Read scoped files once. For each file, check ALL domains simultaneously:
IAM
Network
Storage
Secrets
Logging & Monitoring
Serverless
ENVIRONMENT DETECTION
Classify each resource's environment from these signals (highest to lowest confidence):
- Explicit tags:
Environment=prod
- Directory path:
envs/prod/, environments/production/
- Resource name contains:
prod, production, staging, dev
- Workspace/provider alias
- Config file name:
cdc-prod.yaml, production.tfvars
Production findings are always higher severity than dev equivalents.
SEVERITY CALIBRATION
Critical: Internet-reachable + exploitable + account-wide blast radius + production. Example: public Lambda with admin IAM and no auth.
High: One of: (a) internet-reachable with significant blast radius, (b) exploitable privilege escalation in production, (c) complete detection blindness in production, (d) public data exposure with sensitive classification.
Skip Medium/Low/Info in fast mode.
OUTPUT FORMAT
Write iac-scan/fast-results.md:
# Fast IaC Security Scan Results
**Repository:** {path}
**Scan date:** {date}
**Mode:** Fast (single-pass, High/Critical only)
## Architecture Summary
{2-3 paragraphs describing the inferred architecture: VPCs, workloads, data stores, entry points, environments. State confidence level.}
## Findings
### {FINDING-ID}: {title}
**Severity:** Critical|High
**Confidence:** {0.0-1.0}
**Domain:** IAM|Network|Storage|Secrets|Logging|Serverless
**Environment:** {prod|dev|staging|shared|unknown}
**Evidence:**
- `{file}:{line}` — `{code snippet}`
**Risk:** {2-3 sentences explaining what an attacker could do, blast radius, detection probability}
**Related findings:** {IDs of findings that compound with this one}
---
{repeat for each finding}
## Cross-Domain Risks
{Brief description of how findings combine across domains. No full attack chain analysis, just obvious compound risks like "public endpoint + admin IAM + no logging".}
## Positive Controls
{Bullet list of good security practices observed.}
## Limitations
- Fast mode: Medium/Low/Info findings omitted.
- No deep attack chain correlation.
- SKILL.md definitions not loaded; detection depth is reduced vs full scan.
- Run `Run IaC security scan` for complete coverage.
Then generate iac-scan/fast-report.html — a self-contained HTML report:
- Clean professional design, dark-mode compatible
- No external dependencies (all CSS inline)
- Executive summary at top
- Severity distribution table
- All findings with evidence
- Architecture summary in prose
- Footer: "Fast scan mode. Run full scan for complete coverage."
