10-cloud-security

Name: 10-cloud-security
Author: Masriyan

190stars37forks

How to install 10-cloud-security?

masriyan/claude-code-cybersecurity-skill/10-cloud-security

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 10-cloud-security

Installs into the current project.

Summary

AWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment

Files · 1

View on GitHub

SKILL.md

1	# Cloud Security & Container Hardening
2
3	## Purpose
4
5	Enable Claude to assist with cloud security assessments across AWS, Azure, and GCP, container and Kubernetes security hardening, Infrastructure as Code (Terraform, CloudFormation, Kubernetes manifests) scanning, and cloud compliance reporting against CIS Benchmarks and major frameworks.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Auditing AWS IAM, S3, security groups, or cloud services
13	- Reviewing Azure RBAC, storage, NSGs, or Key Vault configuration
14	- Assessing GCP IAM, Cloud Storage, or GKE security
15	- Scanning Terraform files, CloudFormation templates, or Kubernetes manifests
16	- Hardening Docker containers or reviewing Dockerfiles
17	- Kubernetes RBAC, pod security, or network policies
18	- Cloud compliance (CIS, SOC2, PCI-DSS, HIPAA)
19	- Container image vulnerability scanning
20	- Cloud architecture security review
21	- IaC security scanning (tfsec, Checkov, Terrascan)
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install pyyaml boto3 requests
29	```
30
31	Recommended cloud security tools:
32	- `AWS CLI` — AWS auditing and management
33	- `ScoutSuite` — Multi-cloud security audit
34	- `Prowler` — AWS/Azure/GCP security assessment
35	- `Checkov` — IaC static analysis
36	- `tfsec` — Terraform security scanner
37	- `Trivy` — Container and IaC vulnerability scanner
38	- `kube-bench` — CIS Kubernetes Benchmark
39	- `Falco` — Container runtime security
40
41	---
42
43	## Core Capabilities
44
45	### 1. AWS Security Auditing
46
47	When the user asks to audit AWS security:
48
49	Quick AWS security checks using CLI:
50	```bash
51	# IAM: Find users without MFA
52	aws iam get-account-summary
53	aws iam list-users \| jq '.Users[].UserName' \| xargs -I{} aws iam list-mfa-devices --user-name {}
54
55	# Find overly permissive policies
56	aws iam list-policies --scope Local --only-attached \| jq '.Policies[].PolicyName'
57
58	# S3: Find public buckets
59	aws s3api list-buckets --query 'Buckets[].Name' \| xargs -I{} aws s3api get-bucket-acl --bucket {}
60	aws s3api list-buckets --query 'Buckets[].Name' \| xargs -I{} aws s3api get-bucket-policy-status --bucket {}
61
62	# Security groups: Find wide-open rules
63	aws ec2 describe-security-groups --filters "Name=ip-permission.cidr,Values=0.0.0.0/0" \
64	--query 'SecurityGroups[*].{ID:GroupId,Name:GroupName,Rules:IpPermissions}'
65
66	# CloudTrail: Verify logging
67	aws cloudtrail describe-trails
68	aws cloudtrail get-trail-status --name [trail-name]
69
70	# Root account check
71	aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'
72	```
73
74	AWS IAM Security Checklist:
75	```
76	Identity & Access Management:
77	[ ] Root account has MFA enabled
78	[ ] Root account has no access keys
79	[ ] All IAM users have MFA enabled
80	[ ] No IAM users with AdministratorAccess unless necessary
81	[ ] All IAM users have individual credentials (no shared)
82	[ ] Password policy: min 14 chars, complexity, rotation ≤90 days
83	[ ] Access keys rotated every 90 days
84	[ ] Unused credentials disabled (>90 days no use)
85	[ ] No inline policies; use managed policies
86
87	S3 Security:
88	[ ] Block Public Access enabled at account level
89	[ ] No buckets with public READ ACL
90	[ ] Server-side encryption enabled (SSE-S3 or SSE-KMS)
91	[ ] Versioning enabled for critical buckets
92	[ ] MFA Delete enabled for critical buckets
93	[ ] Access logging enabled
94	[ ] Bucket policies use HTTPS-only conditions
95
96	Networking:
97	[ ] No security groups with 0.0.0.0/0 → port 22 (SSH)
98	[ ] No security groups with 0.0.0.0/0 → port 3389 (RDP)
99	[ ] VPC Flow Logs enabled
100	[ ] No default VPC in use for production workloads
101	[ ] Private subnets for database and application tiers
102
103	Monitoring & Detection:
104	[ ] CloudTrail enabled in all regions
105	[ ] CloudTrail log file integrity validation enabled
106	[ ] GuardDuty enabled
107	[ ] Security Hub enabled and findings reviewed
108	[ ] Config rules configured for compliance
109	[ ] CloudWatch alarms for: root login, failed auth, security group changes
110	```
111
112	Critical AWS Finding Templates:
113	```markdown
114	CRITICAL: S3 Bucket Publicly Readable
115	Bucket: example-data-prod
116	Finding: GetBucketAcl returns AllUsers:READ
117	Risk: All objects publicly readable — potential data breach
118	Fix: aws s3api put-bucket-acl --bucket example-data-prod --acl private
119	Enable: aws s3api put-public-access-block --bucket example-data-prod \
120	--public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
121
122	HIGH: Security Group Allows SSH from Internet
123	Group: sg-0abc123 (web-servers)
124	Rule: Inbound TCP 22 from 0.0.0.0/0
125	Risk: SSH brute-force, CVE exploitation
126	Fix: Change source from 0.0.0.0/0 to your VPN/bastion host IP
127	```
128
129	### 2. Azure Security Auditing
130
131	When the user asks to audit Azure:
132
133	```bash
134	# Login and set subscript

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

10-cloud-security

190stars37forks

View on GitHub

How to install 10-cloud-security?

masriyan/claude-code-cybersecurity-skill/10-cloud-security

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 10-cloud-security

Installs into the current project.

Summary

AWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment

Files · 1

View on GitHub

SKILL.md

1	# Cloud Security & Container Hardening
2
3	## Purpose
4
5	Enable Claude to assist with cloud security assessments across AWS, Azure, and GCP, container and Kubernetes security hardening, Infrastructure as Code (Terraform, CloudFormation, Kubernetes manifests) scanning, and cloud compliance reporting against CIS Benchmarks and major frameworks.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Auditing AWS IAM, S3, security groups, or cloud services
13	- Reviewing Azure RBAC, storage, NSGs, or Key Vault configuration
14	- Assessing GCP IAM, Cloud Storage, or GKE security
15	- Scanning Terraform files, CloudFormation templates, or Kubernetes manifests
16	- Hardening Docker containers or reviewing Dockerfiles
17	- Kubernetes RBAC, pod security, or network policies
18	- Cloud compliance (CIS, SOC2, PCI-DSS, HIPAA)
19	- Container image vulnerability scanning
20	- Cloud architecture security review
21	- IaC security scanning (tfsec, Checkov, Terrascan)
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install pyyaml boto3 requests
29	```
30
31	Recommended cloud security tools:
32	- `AWS CLI` — AWS auditing and management
33	- `ScoutSuite` — Multi-cloud security audit
34	- `Prowler` — AWS/Azure/GCP security assessment
35	- `Checkov` — IaC static analysis
36	- `tfsec` — Terraform security scanner
37	- `Trivy` — Container and IaC vulnerability scanner
38	- `kube-bench` — CIS Kubernetes Benchmark
39	- `Falco` — Container runtime security
40
41	---
42
43	## Core Capabilities
44
45	### 1. AWS Security Auditing
46
47	When the user asks to audit AWS security:
48
49	Quick AWS security checks using CLI:
50	```bash
51	# IAM: Find users without MFA
52	aws iam get-account-summary
53	aws iam list-users \| jq '.Users[].UserName' \| xargs -I{} aws iam list-mfa-devices --user-name {}
54
55	# Find overly permissive policies
56	aws iam list-policies --scope Local --only-attached \| jq '.Policies[].PolicyName'
57
58	# S3: Find public buckets
59	aws s3api list-buckets --query 'Buckets[].Name' \| xargs -I{} aws s3api get-bucket-acl --bucket {}
60	aws s3api list-buckets --query 'Buckets[].Name' \| xargs -I{} aws s3api get-bucket-policy-status --bucket {}
61
62	# Security groups: Find wide-open rules
63	aws ec2 describe-security-groups --filters "Name=ip-permission.cidr,Values=0.0.0.0/0" \
64	--query 'SecurityGroups[*].{ID:GroupId,Name:GroupName,Rules:IpPermissions}'
65
66	# CloudTrail: Verify logging
67	aws cloudtrail describe-trails
68	aws cloudtrail get-trail-status --name [trail-name]
69
70	# Root account check
71	aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'
72	```
73
74	AWS IAM Security Checklist:
75	```
76	Identity & Access Management:
77	[ ] Root account has MFA enabled
78	[ ] Root account has no access keys
79	[ ] All IAM users have MFA enabled
80	[ ] No IAM users with AdministratorAccess unless necessary
81	[ ] All IAM users have individual credentials (no shared)
82	[ ] Password policy: min 14 chars, complexity, rotation ≤90 days
83	[ ] Access keys rotated every 90 days
84	[ ] Unused credentials disabled (>90 days no use)
85	[ ] No inline policies; use managed policies
86
87	S3 Security:
88	[ ] Block Public Access enabled at account level
89	[ ] No buckets with public READ ACL
90	[ ] Server-side encryption enabled (SSE-S3 or SSE-KMS)
91	[ ] Versioning enabled for critical buckets
92	[ ] MFA Delete enabled for critical buckets
93	[ ] Access logging enabled
94	[ ] Bucket policies use HTTPS-only conditions
95
96	Networking:
97	[ ] No security groups with 0.0.0.0/0 → port 22 (SSH)
98	[ ] No security groups with 0.0.0.0/0 → port 3389 (RDP)
99	[ ] VPC Flow Logs enabled
100	[ ] No default VPC in use for production workloads
101	[ ] Private subnets for database and application tiers
102
103	Monitoring & Detection:
104	[ ] CloudTrail enabled in all regions
105	[ ] CloudTrail log file integrity validation enabled
106	[ ] GuardDuty enabled
107	[ ] Security Hub enabled and findings reviewed
108	[ ] Config rules configured for compliance
109	[ ] CloudWatch alarms for: root login, failed auth, security group changes
110	```
111
112	Critical AWS Finding Templates:
113	```markdown
114	CRITICAL: S3 Bucket Publicly Readable
115	Bucket: example-data-prod
116	Finding: GetBucketAcl returns AllUsers:READ
117	Risk: All objects publicly readable — potential data breach
118	Fix: aws s3api put-bucket-acl --bucket example-data-prod --acl private
119	Enable: aws s3api put-public-access-block --bucket example-data-prod \
120	--public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
121
122	HIGH: Security Group Allows SSH from Internet
123	Group: sg-0abc123 (web-servers)
124	Rule: Inbound TCP 22 from 0.0.0.0/0
125	Risk: SSH brute-force, CVE exploitation
126	Fix: Change source from 0.0.0.0/0 to your VPN/bastion host IP
127	```
128
129	### 2. Azure Security Auditing
130
131	When the user asks to audit Azure:
132
133	```bash
134	# Login and set subscript

People who liked this also viewed

6 picks

Type