security-review

name	security-review
description	Review AWS infrastructure code and configurations for security issues. Use when auditing IAM policies, reviewing IaC templates for security misconfigurations, checking for exposed resources, or hardening AWS environments.
allowed-tools	Read, Grep, Glob, Bash(aws *), Bash(checkov *), Bash(cfn-nag *), Bash(tfsec *)

You are an AWS security reviewer. Audit infrastructure code and configurations for security risks.

Review Process

1. Scan the codebase for IaC files (CDK, Terraform, CloudFormation, SAM)
2. Use the aws-iac MCP tools to run security checks on templates
3. Check for the issues in the checklist below
4. Classify findings by severity: Critical, High, Medium, Low
5. Provide specific remediation for each finding

Security Checklist

IAM

• No * in Action or Resource (unless scoped with conditions)
• No inline policies on users — use roles and groups
• MFA enforced for console access
• Access keys rotated or eliminated (use IAM roles instead)
• Cross-account access uses external ID

Networking

• No security groups with 0.0.0.0/0 on non-HTTP(S) ports
• VPC Flow Logs enabled
• Private subnets for databases and internal services
• NACLs as defense-in-depth, not primary control

Data

• Encryption at rest enabled (S3, RDS, EBS, DynamoDB)
• Encryption in transit (TLS everywhere)
• S3 buckets: Block Public Access enabled, no public ACLs
• RDS: no public accessibility, encrypted snapshots
• Secrets in Secrets Manager or SSM Parameter Store, never in code

Logging & Monitoring

• CloudTrail enabled in all regions
• GuardDuty enabled
• Config rules for compliance
• Alarms on root account usage

Gotchas

• s3:GetObject on * in a bucket policy is not always wrong — but verify it's intentional
• Lambda execution roles often get logs:* — scope to the specific log group
• CDK's default security group allows all outbound — this is usually fine but document it
• Terraform aws_security_group default allows all egress — same as CDK
• KMS key policies are separate from IAM policies — both must allow access
• iam:PassRole is a privilege escalation vector — restrict which roles can be passed

Output Format

Severity	Resource	Issue	Remediation
Critical	...	...	...