What problem does it solve? AWS environments accumulate security risks across many services — overprivileged IAM roles, public S3 buckets, open security groups, unpatched CVEs, and active threats — and manually auditing each one with the CLI is slow and error-prone. This Skill provides structured decision trees, ready-to-run AWS CLI commands, and severity-based triage playbooks so you can assess posture and respond to incidents systematically. ## Core Features & Use Cases - IAM Security Assessment: Audit credential hygiene (MFA gaps, stale keys, root access keys), detect overprivileged policies and privilege-escalation paths, and review cross-account trust relationships. - Threat & Finding Triage: Prioritize GuardDuty findings by type and severity, triage Security Hub CIS benchmark failures, and rank Inspector CVEs using a CVSS/network-reachability/exploit-availability matrix. - Configuration & Compliance Audits: Check S3 public access, security groups and NACLs with 0.0.0.0/0 exposure, KMS key rotation, EBS/RDS/S3 encryption, CloudTrail integrity, WAF rules, and AWS Config compliance. - Incident Response: Isolate compromised EC2 instances with quarantine security groups, disable compromised IAM credentials, and create forensic snapshots before termination. - Use Case: After a GuardDuty CRITICAL finding for UnauthorizedAccess:IAMUser, follow the playbook to look up the principal's CloudTrail activity, check for persistence mechanisms, disable the credentials, and verify no new access keys were created. ## Quick Start Ask the agent to run a security posture review of my AWS account covering IAM credential hygiene, open security groups, public S3 buckets, and active GuardDuty and Security Hub findings.
