aws-compliance-checker

name	aws-compliance-checker
description	Automated compliance checking against CIS, PCI-DSS, HIPAA, and SOC 2 benchmarks
category	security
risk	safe
source	community
tags	[aws, compliance, audit, cis, pci-dss, hipaa, kiro-cli]
date_added	2026-02-27

AWS Compliance Checker

Automated compliance validation against industry standards including CIS AWS Foundations, PCI-DSS, HIPAA, and SOC 2.

When to Use

Use this skill when you need to validate AWS compliance against industry standards, prepare for audits, or maintain continuous compliance monitoring.

Supported Frameworks

CIS AWS Foundations Benchmark

• Identity and Access Management
• Logging and Monitoring
• Networking
• Data Protection

PCI-DSS (Payment Card Industry)

• Network security
• Access controls
• Encryption
• Monitoring and logging

HIPAA (Healthcare)

• Access controls
• Audit controls
• Data encryption
• Transmission security

SOC 2

• Security
• Availability
• Confidentiality
• Privacy

CIS AWS Foundations Checks

Identity & Access Management (1.x)

#!/bin/bash
# cis-iam-checks.sh

echo "=== CIS IAM Compliance Checks ==="

# 1.1: Root account usage
echo "1.1: Checking root account usage..."
root_usage=$(aws iam get-credential-report --output text | \
  awk -F, 'NR==2 {print $5,$11}')
echo "  Root password last used: $root_usage"

# 1.2: MFA on root account
echo "1.2: Checking root MFA..."
root_mfa=$(aws iam get-account-summary \
  --query 'SummaryMap.AccountMFAEnabled' --output text)
echo "  Root MFA enabled: $root_mfa"

# 1.3: Unused credentials
echo "1.3: Checking for unused credentials (>90 days)..."
aws iam get-credential-report --output text | \
  awk -F, 'NR>1 {
    if ($5 != "N/A" && $5 != "no_information") {
      cmd = "date -d \"" $5 "\" +%s"
      cmd | getline last_used
      close(cmd)
      now = systime()
      days = (now - last_used) / 86400
      if (days > 90) print "  ⚠️  " $1 ": " int(days) " days inactive"
    }
  }'

# 1.4: Access keys rotated
echo "1.4: Checking access key age..."
aws iam list-users --query 'Users[*].UserName' --output text | \
while read user; do
  aws iam list-access-keys --user-name "$user" \
    --query 'AccessKeyMetadata[*].[AccessKeyId,CreateDate]' \
    --output text | \
  while read key_id create_date; do
    age_days=$(( ($(date +%s) - $(date -d "$create_date" +%s)) / 86400 ))
    if [ $age_days -gt 90 ]; then
       
    
  



 
policy=$(aws iam get-account-password-policy 2>&1)
   | grep -q ; 
   

   
    | jq 



 
aws iam get-credential-report --output text | \
  awk -F, 

Logging (2.x)

#!/bin/bash
# cis-logging-checks.sh

echo "=== CIS Logging Compliance Checks ==="

# 2.1: CloudTrail enabled
echo "2.1: Checking CloudTrail..."
trails=$(aws cloudtrail describe-trails \
  --query 'trailList[*].[Name,IsMultiRegionTrail,LogFileValidationEnabled]' \
  --output text)

if [ -z "$trails" ]; then
  echo "  ❌ No CloudTrail configured"
else
  echo "$trails" | while read name multi_region validation; do
    echo "  Trail: $name"
    echo "    Multi-region: $multi_region"
    echo "    Log validation: $validation"
    
    # Check if logging
    status=$(aws cloudtrail get-trail-status --name "$name" \
      --query 'IsLogging' --output text)
    echo "    Is logging: $status"
  done
fi

# 2.2: CloudTrail log file validation
echo "2.2: Checking log file validation..."
aws cloudtrail describe-trails \
  --query 'trailList[?LogFileValidationEnabled==`false`].Name' \
  --output text | \
while read trail; do
  echo 



 
aws cloudtrail describe-trails \
  --query  --output text | \
  bucket; 
  public=$(aws s3api get-bucket-acl --bucket  2>&1 | \
    grep -c )
   [  -gt 0 ]; 
     
  
     
  



 
aws cloudtrail describe-trails \
  --query  \
  --output text | \
  name log_group; 
   [  =  ]; 
     
  
     
  



 
recorders=$(aws configservice describe-configuration-recorders \
  --query  --output text)

 [ -z  ]; 
   

   



 
aws s3api list-buckets --query  --output text | \
  bucket; 
  logging=$(aws s3api get-bucket-logging --bucket  2>&1)
   !   | grep -q ; 
     
  



 
aws ec2 describe-vpcs --query  --output text | \
  vpc; 
  flow_logs=$(aws ec2 describe-flow-logs \
    --filter  \
    --query  --output text)
   [ -z  ]; 
     
  
     
  

Monitoring (3.x)

#!/bin/bash
# cis-monitoring-checks.sh

echo "=== CIS Monitoring Compliance Checks ==="

# Check for required CloudWatch metric filters and alarms
required_filters=(
  "unauthorized-api-calls"
  "no-mfa-console-signin"
  "root-usage"
  "iam-changes"
  "cloudtrail-changes"
  "console-signin-failures"
  "cmk-changes"
  "s3-bucket-policy-changes"
  "aws-config-changes"
  "security-group-changes"
  "nacl-changes"
  "network-gateway-changes"
  "route-table-changes"
  "vpc-changes"
)

log_group=$(aws cloudtrail describe-trails \
  --query 'trailList[0].CloudWatchLogsLogGroupArn' \
  --output text | cut -d: -f7)

if [ -z "$log_group" ] || [ "$log_group" = "None" ]; then
  echo "  ❌ CloudTrail not integrated with CloudWatch Logs"
else
  echo "Checking metric filters for log group: $log_group"
  
  existing_filters=$(aws logs describe-metric-filters \
    --log-group-name "$log_group" \
    --query 'metricFilters[*].filterName' --output text)
  
  for filter in "${required_filters[@]}"; do
    if echo "$existing_filters" | grep -q ; 
       
    
       
    
  

Networking (4.x)

#!/bin/bash
# cis-networking-checks.sh

echo "=== CIS Networking Compliance Checks ==="

# 4.1: No security groups allow 0.0.0.0/0 ingress to port 22
echo "4.1: Checking SSH access (port 22)..."
aws ec2 describe-security-groups \
  --query 'SecurityGroups[*].[GroupId,GroupName,IpPermissions]' \
  --output json | \
jq -r '.[] | select(.[2][]? | 
  select(.FromPort == 22 and .IpRanges[]?.CidrIp == "0.0.0.0/0")) | 
  "  ⚠️  \(.[0]): \(.[1]) allows SSH from 0.0.0.0/0"'

# 4.2: No security groups allow 0.0.0.0/0 ingress to port 3389
echo "4.2: Checking RDP access (port 3389)..."
aws ec2 describe-security-groups \
  --query 'SecurityGroups[*].[GroupId,GroupName,IpPermissions]' \
  --output json | \
jq -r '.[] | select(.[2][]? | 
  select(.FromPort == 3389 and .IpRanges[]?.CidrIp == "0.0.0.0/0")) | 
  "  ⚠️  \(.[0]): \(.[1]) allows RDP from 0.0.0.0/0"'

# 4.3: Default security group restricts all traffic
echo "4.3: Checking default security groups..."
aws ec2 describe-security-groups \
  --filters Name=group-name,Values=default \
  --query 'SecurityGroups[*].[GroupId,IpPermissions,IpPermissionsEgress]' \
  --output json | \
jq -r '.[] | select((.[1] | length) > 0 or (.[2] | length) > 1) | 
  "  ⚠️  \(.[0]): Default SG has rules"'

PCI-DSS Compliance Checks

#!/usr/bin/env python3
# pci-dss-checker.py

import boto3

def check_pci_compliance():
    """Check PCI-DSS requirements"""
    
    ec2 = boto3.client('ec2')
    rds = boto3.client('rds')
    s3 = boto3.client('s3')
    
    issues = []
    
    # Requirement 1: Network security
    sgs = ec2.describe_security_groups()
    for sg in sgs['SecurityGroups']:
        for perm in sg.get('IpPermissions', []):
            for ip_range in perm.get('IpRanges', []):
                if ip_range.get('CidrIp') == '0.0.0.0/0':
                    issues.append(f"PCI 1.2: {sg['GroupId']} open to internet")
    
    # Requirement 2: Secure configurations
    # Check for default passwords, etc.
    
    # Requirement 3: Protect cardholder data
    volumes = ec2.describe_volumes()
    for vol in volumes['Volumes']:
        if not vol['Encrypted']:
            issues.append(f"PCI 3.4: Volume {vol['VolumeId']} not encrypted")
    
    # Requirement 4: Encrypt transmission
    # Check for SSL/TLS on load balancers
    
    # Requirement 8: Access controls
    iam = boto3.client('iam')
    users = iam.list_users()
    for user in users[]:
        mfa = iam.list_mfa_devices(UserName=user[])
          mfa[]:
            issues.append()
    
    
    cloudtrail = boto3.client()
    trails = cloudtrail.describe_trails()
      trails[]:
        issues.append()
    
     issues

 __name__ == :
    ()
    ( * )
    
    issues = check_pci_compliance()
    
      issues:
        ()
    :
        ()
         issue  issues:
            ()

HIPAA Compliance Checks

#!/bin/bash
# hipaa-checker.sh

echo "=== HIPAA Compliance Checks ==="

# Access Controls (164.308(a)(3))
echo "Access Controls:"
aws iam get-credential-report --output text | \
  awk -F, 'NR>1 && $4=="false" {print "  ⚠️  " $1 ": No MFA (164.312(a)(2)(i))"}'

# Audit Controls (164.312(b))
echo ""
echo "Audit Controls:"
trails=$(aws cloudtrail describe-trails --query 'trailList[*].Name' --output text)
if [ -z "$trails" ]; then
  echo "  ❌ No CloudTrail (164.312(b))"
else
  echo "  ✓ CloudTrail enabled"
fi

# Encryption (164.312(a)(2)(iv))
echo ""
echo "Encryption at Rest:"
aws ec2 describe-volumes \
  --query 'Volumes[?Encrypted==`false`].VolumeId' \
  --output text | \
while read vol; do
  echo "  ⚠️  $vol: Not encrypted (164.312(a)(2)(iv))"
done

aws rds describe-db-instances \
  --query 'DBInstances[?StorageEncrypted==`false`].DBInstanceIdentifier' \
  --output text | \
while read db; do
  echo "  ⚠️  $db: Not encrypted (164.312(a)(2)(iv))"
done

# Transmission Security (164.312(e)(1))
 
 
 

Automated Compliance Reporting

#!/usr/bin/env python3
# compliance-report.py

import boto3
import json
from datetime import datetime

def generate_compliance_report(framework='cis'):
    """Generate comprehensive compliance report"""
    
    report = {
        'framework': framework,
        'generated': datetime.now().isoformat(),
        'checks': [],
        'summary': {
            'total': 0,
            'passed': 0,
            'failed': 0,
            'score': 0
        }
    }
    
    # Run all checks based on framework
    if framework == 'cis':
        checks = run_cis_checks()
    elif framework == 'pci':
        checks = run_pci_checks()
    elif framework == 'hipaa':
        checks = run_hipaa_checks()
    
    report['checks'] = checks
    report['summary']['total'] = len(checks)
    report['summary']['passed'] = sum(1 for c in checks if c['status'] == 'PASS')
    report['summary']['failed'] = report['summary']['total'] - report[][]
    report[][] = (report[][] / report[][]) * 
    
     report

 ():
    
     []

 ():
    
     []

 ():
    
     []

 __name__ == :
     sys
    framework = sys.argv[]  (sys.argv) >   
    
    report = generate_compliance_report(framework)
    
    ()
    ( * )
    ()
    ()
    ()
    
    
     (, )  f:
        json.dump(report, f, indent=)

Example Prompts

• "Run CIS AWS Foundations compliance check"
• "Generate a PCI-DSS compliance report"
• "Check HIPAA compliance for my AWS account"
• "Audit against SOC 2 requirements"
• "Create a compliance dashboard"

Best Practices

• Run compliance checks weekly
• Automate with Lambda/EventBridge
• Track compliance trends over time
• Document exceptions with justification
• Integrate with AWS Security Hub
• Use AWS Config Rules for continuous monitoring

Kiro CLI Integration

kiro-cli chat "Use aws-compliance-checker to run CIS benchmark"
kiro-cli chat "Generate PCI-DSS report with aws-compliance-checker"

Additional Resources

• CIS AWS Foundations Benchmark
• AWS Security Hub
• AWS Compliance Programs