| name | stave-snapshot-your-account |
| description | Capture a read-only configuration snapshot of your real AWS account and evaluate it with Stave on a local, deterministic snapshot |
| triggers | ["evaluate my account","scan my AWS","snapshot my environment","real environment findings","run Stave for real"] |
| requires | ["a built stave binary (run stave-setup first)","AWS CLI with a READ-ONLY profile (SecurityAudit / ReadOnlyAccess)"] |
stave-snapshot-your-account
What this skill does
Captures a point-in-time config snapshot of your AWS account and evaluates it.
This is the real thing — but Stave only ever reads a LOCAL snapshot; it never
connects to or writes to AWS.
Time: ~30 minutes. Real AWS, read-only.
Prerequisites — read-only only
aws sts get-caller-identity --profile <your-readonly-profile>
The profile MUST be read-only (e.g. the AWS-managed SecurityAudit or
ReadOnlyAccess policy). Do NOT use admin/write credentials — capture needs
only reads.
Steps
1. Confirm read-only access
Verify the caller's attached policies are read/audit only before proceeding.
2. Capture a snapshot
Pull the configuration you want to evaluate with read-only AWS CLI calls (e.g.
aws iam list-users, list-attached-user-policies, get-policy-version,
aws s3api get-bucket-policy, …) and save the raw JSON. This is the same
capture pattern used in the lab-validation skill — adapt the resource list and
naming to your account.
3. Build observations
Transform the captured config into obs.v0.1 observation files:
- one or more snapshot files (≥ 2 timestamps if you want duration-based controls
to evaluate dwell time),
schema_version: obs.v0.1, source: deployed,- per-asset
properties populated with the exact fields the relevant controls
read (find them with ./stave search + the control's observation_fields,
same as lab-validation step 4).
jq . <your-obs-dir>/*.json > /dev/null && echo "valid JSON"
4. Evaluate
./stave apply --observations <your-obs-dir>/ --eval-time <RFC3339-now>
5. Review findings
Each finding is a property of YOUR environment, with evidence and remediation.
Triage by severity; the remediation field says what to change.
Important
- Stave evaluates a LOCAL snapshot — it never calls AWS. Capture is the only AWS step, and it's read-only.
- A snapshot is point-in-time: findings reflect the captured moment, not live state.
- Deterministic: same snapshot + same
--eval-time → identical findings, always.
Success
You've evaluated your real environment. Findings are specific to your
infrastructure, each with evidence and remediation guidance.
