[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EXCDX0DNV98A7J68R2KS2C":3,"skill-same:01M6EXCDX0DNV98A7J68R2KS2C":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":52,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M6EXCDX0DNV98A7J68R2KS2C","aws-compliance-checker",null,"Automated compliance checking against CIS, PCI-DSS, HIPAA, and SOC 2 benchmarks","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Faws-compliance-checker\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"compliance checker","compliance","aws compliance checker","aws","pci-dss","kiro-cli","dss","kiro","community","benchmarks","cis","cli","hipaa","soc","audit","security","safe","2026-11-10 10:12:30",false,"---\nname: aws-compliance-checker\ndescription: Automated compliance checking against CIS, PCI-DSS, HIPAA, and SOC 2 benchmarks\nrisk: safe\nsource: community\ncategory: security\ntags: [aws, compliance, audit, cis, pci-dss, hipaa, kiro-cli]\n---\n\n# AWS Compliance Checker\n\nAutomated compliance validation against industry standards including CIS AWS Foundations, PCI-DSS, HIPAA, and SOC 2.\n\n## When to Use\n\nUse this skill when you need to validate AWS compliance against industry standards, prepare for audits, or maintain continuous compliance monitoring.\n\n## Supported Frameworks\n\n**CIS AWS Foundations Benchmark**\n- Identity and Access Management\n- Logging and Monitoring\n- Networking\n- Data Protection\n\n**PCI-DSS (Payment Card Industry)**\n- Network security\n- Access controls\n- Encryption\n- Monitoring and logging\n\n**HIPAA (Healthcare)**\n- Access controls\n- Audit controls\n- Data encryption\n- Transmission security\n\n**SOC 2**\n- Security\n- Availability\n- Confidentiality\n- Privacy\n\n## CIS AWS Foundations Checks\n\n### Identity & Access Management (1.x)\n\n```bash\n#!\u002Fbin\u002Fbash\n# cis-iam-checks.sh\n\necho \"=== CIS IAM Compliance Checks ===\"\n\n# 1.1: Root account usage\necho \"1.1: Checking root account usage...\"\nroot_usage=$(aws iam get-credential-report --output text | \\\n  awk -F, 'NR==2 {print $5,$11}')\necho \"  Root password last used: $root_usage\"\n\n# 1.2: MFA on root account\necho \"1.2: Checking root MFA...\"\nroot_mfa=$(aws iam get-account-summary \\\n  --query 'SummaryMap.AccountMFAEnabled' --output text)\necho \"  Root MFA enabled: $root_mfa\"\n\n# 1.3: Unused credentials\necho \"1.3: Checking for unused credentials (>90 days)...\"\naws iam get-credential-report --output text | \\\n  awk -F, 'NR>1 {\n    if ($5 != \"N\u002FA\" && $5 != \"no_information\") {\n      cmd = \"date -d \\\"\" $5 \"\\\" +%s\"\n      cmd | getline last_used\n      close(cmd)\n      now = systime()\n      days = (now - last_used) \u002F 86400\n      if (days > 90) print \"  ⚠️  \" $1 \": \" int(days) \" days inactive\"\n    }\n  }'\n\n# 1.4: Access keys rotated\necho \"1.4: Checking access key age...\"\naws iam list-users --query 'Users[*].UserName' --output text | \\\nwhile read user; do\n  aws iam list-access-keys --user-name \"$user\" \\\n    --query 'AccessKeyMetadata[*].[AccessKeyId,CreateDate]' \\\n    --output text | \\\n  while read key_id create_date; do\n    age_days=$(( ($(date +%s) - $(date -d \"$create_date\" +%s)) \u002F 86400 ))\n    if [ $age_days -gt 90 ]; then\n      echo \"  ⚠️  $user: Key $key_id is $age_days days old\"\n    fi\n  done\ndone\n\n# 1.5-1.11: Password policy\necho \"1.5-1.11: Checking password policy...\"\npolicy=$(aws iam get-account-password-policy 2>&1)\nif echo \"$policy\" | grep -q \"NoSuchEntity\"; then\n  echo \"  ❌ No password policy configured\"\nelse\n  echo \"  ✓ Password policy exists\"\n  echo \"$policy\" | jq '.PasswordPolicy | {\n    MinimumPasswordLength,\n    RequireSymbols,\n    RequireNumbers,\n    RequireUppercaseCharacters,\n    RequireLowercaseCharacters,\n    MaxPasswordAge,\n    PasswordReusePrevention\n  }'\nfi\n\n# 1.12-1.14: MFA for IAM users\necho \"1.12-1.14: Checking IAM user MFA...\"\naws iam get-credential-report --output text | \\\n  awk -F, 'NR>1 && $4==\"false\" {print \"  ⚠️  \" $1 \": No MFA\"}'\n```\n\n### Logging (2.x)\n\n```bash\n#!\u002Fbin\u002Fbash\n# cis-logging-checks.sh\n\necho \"=== CIS Logging Compliance Checks ===\"\n\n# 2.1: CloudTrail enabled\necho \"2.1: Checking CloudTrail...\"\ntrails=$(aws cloudtrail describe-trails \\\n  --query 'trailList[*].[Name,IsMultiRegionTrail,LogFileValidationEnabled]' \\\n  --output text)\n\nif [ -z \"$trails\" ]; then\n  echo \"  ❌ No CloudTrail configured\"\nelse\n  echo \"$trails\" | while read name multi_region validation; do\n    echo \"  Trail: $name\"\n    echo \"    Multi-region: $multi_region\"\n    echo \"    Log validation: $validation\"\n    \n    # Check if logging\n    status=$(aws cloudtrail get-trail-status --name \"$name\" \\\n      --query 'IsLogging' --output text)\n    echo \"    Is logging: $status\"\n  done\nfi\n\n# 2.2: CloudTrail log file validation\necho \"2.2: Checking log file validation...\"\naws cloudtrail describe-trails \\\n  --query 'trailList[?LogFileValidationEnabled==`false`].Name' \\\n  --output text | \\\nwhile read trail; do\n  echo \"  ⚠️  $trail: Log validation disabled\"\ndone\n\n# 2.3: S3 bucket for CloudTrail\necho \"2.3: Checking CloudTrail S3 bucket access...\"\naws cloudtrail describe-trails \\\n  --query 'trailList[*].S3BucketName' --output text | \\\nwhile read bucket; do\n  public=$(aws s3api get-bucket-acl --bucket \"$bucket\" 2>&1 | \\\n    grep -c \"AllUsers\")\n  if [ \"$public\" -gt 0 ]; then\n    echo \"  ❌ $bucket: Publicly accessible\"\n  else\n    echo \"  ✓ $bucket: Not public\"\n  fi\ndone\n\n# 2.4: CloudTrail integrated with CloudWatch Logs\necho \"2.4: Checking CloudWatch Logs integration...\"\naws cloudtrail describe-trails \\\n  --query 'trailList[*].[Name,CloudWatchLogsLogGroupArn]' \\\n  --output text | \\\nwhile read name log_group; do\n  if [ \"$log_group\" = \"None\" ]; then\n    echo \"  ⚠️  $name: Not integrated with CloudWatch Logs\"\n  else\n    echo \"  ✓ $name: Integrated with CloudWatch\"\n  fi\ndone\n\n# 2.5: AWS Config enabled\necho \"2.5: Checking AWS Config...\"\nrecorders=$(aws configservice describe-configuration-recorders \\\n  --query 'ConfigurationRecorders[*].name' --output text)\n\nif [ -z \"$recorders\" ]; then\n  echo \"  ❌ AWS Config not enabled\"\nelse\n  echo \"  ✓ AWS Config enabled: $recorders\"\nfi\n\n# 2.6: S3 bucket logging\necho \"2.6: Checking S3 bucket logging...\"\naws s3api list-buckets --query 'Buckets[*].Name' --output text | \\\nwhile read bucket; do\n  logging=$(aws s3api get-bucket-logging --bucket \"$bucket\" 2>&1)\n  if ! echo \"$logging\" | grep -q \"LoggingEnabled\"; then\n    echo \"  ⚠️  $bucket: Access logging disabled\"\n  fi\ndone\n\n# 2.7: VPC Flow Logs\necho \"2.7: Checking VPC Flow Logs...\"\naws ec2 describe-vpcs --query 'Vpcs[*].VpcId' --output text | \\\nwhile read vpc; do\n  flow_logs=$(aws ec2 describe-flow-logs \\\n    --filter \"Name=resource-id,Values=$vpc\" \\\n    --query 'FlowLogs[*].FlowLogId' --output text)\n  if [ -z \"$flow_logs\" ]; then\n    echo \"  ⚠️  $vpc: No flow logs enabled\"\n  else\n    echo \"  ✓ $vpc: Flow logs enabled\"\n  fi\ndone\n```\n\n### Monitoring (3.x)\n\n```bash\n#!\u002Fbin\u002Fbash\n# cis-monitoring-checks.sh\n\necho \"=== CIS Monitoring Compliance Checks ===\"\n\n# Check for required CloudWatch metric filters and alarms\nrequired_filters=(\n  \"unauthorized-api-calls\"\n  \"no-mfa-console-signin\"\n  \"root-usage\"\n  \"iam-changes\"\n  \"cloudtrail-changes\"\n  \"console-signin-failures\"\n  \"cmk-changes\"\n  \"s3-bucket-policy-changes\"\n  \"aws-config-changes\"\n  \"security-group-changes\"\n  \"nacl-changes\"\n  \"network-gateway-changes\"\n  \"route-table-changes\"\n  \"vpc-changes\"\n)\n\nlog_group=$(aws cloudtrail describe-trails \\\n  --query 'trailList[0].CloudWatchLogsLogGroupArn' \\\n  --output text | cut -d: -f7)\n\nif [ -z \"$log_group\" ] || [ \"$log_group\" = \"None\" ]; then\n  echo \"  ❌ CloudTrail not integrated with CloudWatch Logs\"\nelse\n  echo \"Checking metric filters for log group: $log_group\"\n  \n  existing_filters=$(aws logs describe-metric-filters \\\n    --log-group-name \"$log_group\" \\\n    --query 'metricFilters[*].filterName' --output text)\n  \n  for filter in \"${required_filters[@]}\"; do\n    if echo \"$existing_filters\" | grep -q \"$filter\"; then\n      echo \"  ✓ $filter: Configured\"\n    else\n      echo \"  ⚠️  $filter: Missing\"\n    fi\n  done\nfi\n```\n\n### Networking (4.x)\n\n```bash\n#!\u002Fbin\u002Fbash\n# cis-networking-checks.sh\n\necho \"=== CIS Networking Compliance Checks ===\"\n\n# 4.1: No security groups allow 0.0.0.0\u002F0 ingress to port 22\necho \"4.1: Checking SSH access (port 22)...\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[*].[GroupId,GroupName,IpPermissions]' \\\n  --output json | \\\njq -r '.[] | select(.[2][]? | \n  select(.FromPort == 22 and .IpRanges[]?.CidrIp == \"0.0.0.0\u002F0\")) | \n  \"  ⚠️  \\(.[0]): \\(.[1]) allows SSH from 0.0.0.0\u002F0\"'\n\n# 4.2: No security groups allow 0.0.0.0\u002F0 ingress to port 3389\necho \"4.2: Checking RDP access (port 3389)...\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[*].[GroupId,GroupName,IpPermissions]' \\\n  --output json | \\\njq -r '.[] | select(.[2][]? | \n  select(.FromPort == 3389 and .IpRanges[]?.CidrIp == \"0.0.0.0\u002F0\")) | \n  \"  ⚠️  \\(.[0]): \\(.[1]) allows RDP from 0.0.0.0\u002F0\"'\n\n# 4.3: Default security group restricts all traffic\necho \"4.3: Checking default security groups...\"\naws ec2 describe-security-groups \\\n  --filters Name=group-name,Values=default \\\n  --query 'SecurityGroups[*].[GroupId,IpPermissions,IpPermissionsEgress]' \\\n  --output json | \\\njq -r '.[] | select((.[1] | length) > 0 or (.[2] | length) > 1) | \n  \"  ⚠️  \\(.[0]): Default SG has rules\"'\n```\n\n## PCI-DSS Compliance Checks\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n# pci-dss-checker.py\n\nimport boto3\n\ndef check_pci_compliance():\n    \"\"\"Check PCI-DSS requirements\"\"\"\n    \n    ec2 = boto3.client('ec2')\n    rds = boto3.client('rds')\n    s3 = boto3.client('s3')\n    \n    issues = []\n    \n    # Requirement 1: Network security\n    sgs = ec2.describe_security_groups()\n    for sg in sgs['SecurityGroups']:\n        for perm in sg.get('IpPermissions', []):\n            for ip_range in perm.get('IpRanges', []):\n                if ip_range.get('CidrIp') == '0.0.0.0\u002F0':\n                    issues.append(f\"PCI 1.2: {sg['GroupId']} open to internet\")\n    \n    # Requirement 2: Secure configurations\n    # Check for default passwords, etc.\n    \n    # Requirement 3: Protect cardholder data\n    volumes = ec2.describe_volumes()\n    for vol in volumes['Volumes']:\n        if not vol['Encrypted']:\n            issues.append(f\"PCI 3.4: Volume {vol['VolumeId']} not encrypted\")\n    \n    # Requirement 4: Encrypt transmission\n    # Check for SSL\u002FTLS on load balancers\n    \n    # Requirement 8: Access controls\n    iam = boto3.client('iam')\n    users = iam.list_users()\n    for user in users['Users']:\n        mfa = iam.list_mfa_devices(UserName=user['UserName'])\n        if not mfa['MFADevices']:\n            issues.append(f\"PCI 8.3: {user['UserName']} no MFA\")\n    \n    # Requirement 10: Logging\n    cloudtrail = boto3.client('cloudtrail')\n    trails = cloudtrail.describe_trails()\n    if not trails['trailList']:\n        issues.append(\"PCI 10.1: No CloudTrail enabled\")\n    \n    return issues\n\nif __name__ == \"__main__\":\n    print(\"PCI-DSS Compliance Check\")\n    print(\"=\" * 50)\n    \n    issues = check_pci_compliance()\n    \n    if not issues:\n        print(\"✓ No PCI-DSS issues found\")\n    else:\n        print(f\"Found {len(issues)} issues:\\n\")\n        for issue in issues:\n            print(f\"  ⚠️  {issue}\")\n```\n\n## HIPAA Compliance Checks\n\n```bash\n#!\u002Fbin\u002Fbash\n# hipaa-checker.sh\n\necho \"=== HIPAA Compliance Checks ===\"\n\n# Access Controls (164.308(a)(3))\necho \"Access Controls:\"\naws iam get-credential-report --output text | \\\n  awk -F, 'NR>1 && $4==\"false\" {print \"  ⚠️  \" $1 \": No MFA (164.312(a)(2)(i))\"}'\n\n# Audit Controls (164.312(b))\necho \"\"\necho \"Audit Controls:\"\ntrails=$(aws cloudtrail describe-trails --query 'trailList[*].Name' --output text)\nif [ -z \"$trails\" ]; then\n  echo \"  ❌ No CloudTrail (164.312(b))\"\nelse\n  echo \"  ✓ CloudTrail enabled\"\nfi\n\n# Encryption (164.312(a)(2)(iv))\necho \"\"\necho \"Encryption at Rest:\"\naws ec2 describe-volumes \\\n  --query 'Volumes[?Encrypted==`false`].VolumeId' \\\n  --output text | \\\nwhile read vol; do\n  echo \"  ⚠️  $vol: Not encrypted (164.312(a)(2)(iv))\"\ndone\n\naws rds describe-db-instances \\\n  --query 'DBInstances[?StorageEncrypted==`false`].DBInstanceIdentifier' \\\n  --output text | \\\nwhile read db; do\n  echo \"  ⚠️  $db: Not encrypted (164.312(a)(2)(iv))\"\ndone\n\n# Transmission Security (164.312(e)(1))\necho \"\"\necho \"Transmission Security:\"\necho \"  Check: All data in transit uses TLS 1.2+\"\n```\n\n## Automated Compliance Reporting\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n# compliance-report.py\n\nimport boto3\nimport json\nfrom datetime import datetime\n\ndef generate_compliance_report(framework='cis'):\n    \"\"\"Generate comprehensive compliance report\"\"\"\n    \n    report = {\n        'framework': framework,\n        'generated': datetime.now().isoformat(),\n        'checks': [],\n        'summary': {\n            'total': 0,\n            'passed': 0,\n            'failed': 0,\n            'score': 0\n        }\n    }\n    \n    # Run all checks based on framework\n    if framework == 'cis':\n        checks = run_cis_checks()\n    elif framework == 'pci':\n        checks = run_pci_checks()\n    elif framework == 'hipaa':\n        checks = run_hipaa_checks()\n    \n    report['checks'] = checks\n    report['summary']['total'] = len(checks)\n    report['summary']['passed'] = sum(1 for c in checks if c['status'] == 'PASS')\n    report['summary']['failed'] = report['summary']['total'] - report['summary']['passed']\n    report['summary']['score'] = (report['summary']['passed'] \u002F report['summary']['total']) * 100\n    \n    return report\n\ndef run_cis_checks():\n    # Implement CIS checks\n    return []\n\ndef run_pci_checks():\n    # Implement PCI checks\n    return []\n\ndef run_hipaa_checks():\n    # Implement HIPAA checks\n    return []\n\nif __name__ == \"__main__\":\n    import sys\n    framework = sys.argv[1] if len(sys.argv) > 1 else 'cis'\n    \n    report = generate_compliance_report(framework)\n    \n    print(f\"\\n{framework.upper()} Compliance Report\")\n    print(\"=\" * 50)\n    print(f\"Score: {report['summary']['score']:.1f}%\")\n    print(f\"Passed: {report['summary']['passed']}\u002F{report['summary']['total']}\")\n    print(f\"Failed: {report['summary']['failed']}\u002F{report['summary']['total']}\")\n    \n    # Save to file\n    with open(f'compliance-{framework}-{datetime.now().strftime(\"%Y%m%d\")}.json', 'w') as f:\n        json.dump(report, f, indent=2)\n```\n\n## Example Prompts\n\n- \"Run CIS AWS Foundations compliance check\"\n- \"Generate a PCI-DSS compliance report\"\n- \"Check HIPAA compliance for my AWS account\"\n- \"Audit against SOC 2 requirements\"\n- \"Create a compliance dashboard\"\n\n## Best Practices\n\n- Run compliance checks weekly\n- Automate with Lambda\u002FEventBridge\n- Track compliance trends over time\n- Document exceptions with justification\n- Integrate with AWS Security Hub\n- Use AWS Config Rules for continuous monitoring\n\n## Kiro CLI Integration\n\n```bash\nkiro-cli chat \"Use aws-compliance-checker to run CIS benchmark\"\nkiro-cli chat \"Generate PCI-DSS report with aws-compliance-checker\"\n```\n\n## Additional Resources\n\n- [CIS AWS Foundations Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Famazon_web_services)\n- [AWS Security Hub](https:\u002F\u002Faws.amazon.com\u002Fsecurity-hub\u002F)\n- [AWS Compliance Programs](https:\u002F\u002Faws.amazon.com\u002Fcompliance\u002Fprograms\u002F)\n","# AWS Compliance Checker\n\nAutomated compliance validation against industry standards including CIS AWS Foundations, PCI-DSS, HIPAA, and SOC 2.\n\n## When to Use\n\nUse this skill when you need to validate AWS compliance against industry standards, prepare for audits, or maintain continuous compliance monitoring.\n\n## Supported Frameworks\n\n**CIS AWS Foundations Benchmark**\n- Identity and Access Management\n- Logging and Monitoring\n- Networking\n- Data Protection\n\n**PCI-DSS (Payment Card Industry)**\n- Network security\n- Access controls\n- Encryption\n- Monitoring and logging\n\n**HIPAA (Healthcare)**\n- Access controls\n- Audit controls\n- Data encryption\n- Transmission security\n\n**SOC 2**\n- Security\n- Availability\n- Confidentiality\n- Privacy\n\n## CIS AWS Foundations Checks\n\n### Identity & Access Management (1.x)\n\n```bash\n#!\u002Fbin\u002Fbash\n# cis-iam-checks.sh\n\necho \"=== CIS IAM Compliance Checks ===\"\n\n# 1.1: Root account usage\necho \"1.1: Checking root account usage...\"\nroot_usage=$(aws iam get-credential-report --output text | \\\n  awk -F, 'NR==2 {print $5,$11}')\necho \"  Root password last used: $root_usage\"\n\n# 1.2: MFA on root account\necho \"1.2: Checking root MFA...\"\nroot_mfa=$(aws iam get-account-summary \\\n  --query 'SummaryMap.AccountMFAEnabled' --output text)\necho \"  Root MFA enabled: $root_mfa\"\n\n# 1.3: Unused credentials\necho \"1.3: Checking for unused credentials (>90 days)...\"\naws iam get-credential-report --output text | \\\n  awk -F, 'NR>1 {\n    if ($5 != \"N\u002FA\" && $5 != \"no_information\") {\n      cmd = \"date -d \\\"\" $5 \"\\\" +%s\"\n      cmd | getline last_used\n      close(cmd)\n      now = systime()\n      days = (now - last_used) \u002F 86400\n      if (days > 90) print \"  ⚠️  \" $1 \": \" int(days) \" days inactive\"\n    }\n  }'\n\n# 1.4: Access keys rotated\necho \"1.4: Checking access key age...\"\naws iam list-users --query 'Users[*].UserName' --output text | \\\nwhile read user; do\n  aws iam list-access-keys --user-name \"$user\" \\\n    --query 'AccessKeyMetadata[*].[AccessKeyId,CreateDate]' \\\n    --output text | \\\n  while read key_id create_date; do\n    age_days=$(( ($(date +%s) - $(date -d \"$create_date\" +%s)) \u002F 86400 ))\n    if [ $age_days -gt 90 ]; then\n      echo \"  ⚠️  $user: Key $key_id is $age_days days old\"\n    fi\n  done\ndone\n\n# 1.5-1.11: Password policy\necho \"1.5-1.11: Checking password policy...\"\npolicy=$(aws iam get-account-password-policy 2>&1)\nif echo \"$policy\" | grep -q \"NoSuchEntity\"; then\n  echo \"  ❌ No password policy configured\"\nelse\n  echo \"  ✓ Password policy exists\"\n  echo \"$policy\" | jq '.PasswordPolicy | {\n    MinimumPasswordLength,\n    RequireSymbols,\n    RequireNumbers,\n    RequireUppercaseCharacters,\n    RequireLowercaseCharacters,\n    MaxPasswordAge,\n    PasswordReusePrevention\n  }'\nfi\n\n# 1.12-1.14: MFA for IAM users\necho \"1.12-1.14: Checking IAM user MFA...\"\naws iam get-credential-report --output text | \\\n  awk -F, 'NR>1 && $4==\"false\" {print \"  ⚠️  \" $1 \": No MFA\"}'\n```\n\n### Logging (2.x)\n\n```bash\n#!\u002Fbin\u002Fbash\n# cis-logging-checks.sh\n\necho \"=== CIS Logging Compliance Checks ===\"\n\n# 2.1: CloudTrail enabled\necho \"2.1: Checking CloudTrail...\"\ntrails=$(aws cloudtrail describe-trails \\\n  --query 'trailList[*].[Name,IsMultiRegionTrail,LogFileValidationEnabled]' \\\n  --output text)\n\nif [ -z \"$trails\" ]; then\n  echo \"  ❌ No CloudTrail configured\"\nelse\n  echo \"$trails\" | while read name multi_region validation; do\n    echo \"  Trail: $name\"\n    echo \"    Multi-region: $multi_region\"\n    echo \"    Log validation: $validation\"\n    \n    # Check if logging\n    status=$(aws cloudtrail get-trail-status --name \"$name\" \\\n      --query 'IsLogging' --output text)\n    echo \"    Is logging: $status\"\n  done\nfi\n\n# 2.2: CloudTrail log file validation\necho \"2.2: Checking log file validation...\"\naws cloudtrail describe-trails \\\n  --query 'trailList[?LogFileValidationEnabled==`false`].Name' \\\n  --output text | \\\nwhile read trail; do\n  echo \"  ⚠️  $trail: Log validation disabled\"\ndone\n\n# 2.3: S3 bucket for CloudTrail\necho \"2.3: Checking CloudTrail S3 bucket access...\"\naws cloudtrail describe-trails \\\n  --query 'trailList[*].S3BucketName' --output text | \\\nwhile read bucket; do\n  public=$(aws s3api get-bucket-acl --bucket \"$bucket\" 2>&1 | \\\n    grep -c \"AllUsers\")\n  if [ \"$public\" -gt 0 ]; then\n    echo \"  ❌ $bucket: Publicly accessible\"\n  else\n    echo \"  ✓ $bucket: Not public\"\n  fi\ndone\n\n# 2.4: CloudTrail integrated with CloudWatch Logs\necho \"2.4: Checking CloudWatch Logs integration...\"\naws cloudtrail describe-trails \\\n  --query 'trailList[*].[Name,CloudWatchLogsLogGroupArn]' \\\n  --output text | \\\nwhile read name log_group; do\n  if [ \"$log_group\" = \"None\" ]; then\n    echo \"  ⚠️  $name: Not integrated with CloudWatch Logs\"\n  else\n    echo \"  ✓ $name: Integrated with CloudWatch\"\n  fi\ndone\n\n# 2.5: AWS Config enabled\necho \"2.5: Checking AWS Config...\"\nrecorders=$(aws configservice describe-configuration-recorders \\\n  --query 'ConfigurationRecorders[*].name' --output text)\n\nif [ -z \"$recorders\" ]; then\n  echo \"  ❌ AWS Config not enabled\"\nelse\n  echo \"  ✓ AWS Config enabled: $recorders\"\nfi\n\n# 2.6: S3 bucket logging\necho \"2.6: Checking S3 bucket logging...\"\naws s3api list-buckets --query 'Buckets[*].Name' --output text | \\\nwhile read bucket; do\n  logging=$(aws s3api get-bucket-logging --bucket \"$bucket\" 2>&1)\n  if ! echo \"$logging\" | grep -q \"LoggingEnabled\"; then\n    echo \"  ⚠️  $bucket: Access logging disabled\"\n  fi\ndone\n\n# 2.7: VPC Flow Logs\necho \"2.7: Checking VPC Flow Logs...\"\naws ec2 describe-vpcs --query 'Vpcs[*].VpcId' --output text | \\\nwhile read vpc; do\n  flow_logs=$(aws ec2 describe-flow-logs \\\n    --filter \"Name=resource-id,Values=$vpc\" \\\n    --query 'FlowLogs[*].FlowLogId' --output text)\n  if [ -z \"$flow_logs\" ]; then\n    echo \"  ⚠️  $vpc: No flow logs enabled\"\n  else\n    echo \"  ✓ $vpc: Flow logs enabled\"\n  fi\ndone\n```\n\n### Monitoring (3.x)\n\n```bash\n#!\u002Fbin\u002Fbash\n# cis-monitoring-checks.sh\n\necho \"=== CIS Monitoring Compliance Checks ===\"\n\n# Check for required CloudWatch metric filters and alarms\nrequired_filters=(\n  \"unauthorized-api-calls\"\n  \"no-mfa-console-signin\"\n  \"root-usage\"\n  \"iam-changes\"\n  \"cloudtrail-changes\"\n  \"console-signin-failures\"\n  \"cmk-changes\"\n  \"s3-bucket-policy-changes\"\n  \"aws-config-changes\"\n  \"security-group-changes\"\n  \"nacl-changes\"\n  \"network-gateway-changes\"\n  \"route-table-changes\"\n  \"vpc-changes\"\n)\n\nlog_group=$(aws cloudtrail describe-trails \\\n  --query 'trailList[0].CloudWatchLogsLogGroupArn' \\\n  --output text | cut -d: -f7)\n\nif [ -z \"$log_group\" ] || [ \"$log_group\" = \"None\" ]; then\n  echo \"  ❌ CloudTrail not integrated with CloudWatch Logs\"\nelse\n  echo \"Checking metric filters for log group: $log_group\"\n  \n  existing_filters=$(aws logs describe-metric-filters \\\n    --log-group-name \"$log_group\" \\\n    --query 'metricFilters[*].filterName' --output text)\n  \n  for filter in \"${required_filters[@]}\"; do\n    if echo \"$existing_filters\" | grep -q \"$filter\"; then\n      echo \"  ✓ $filter: Configured\"\n    else\n      echo \"  ⚠️  $filter: Missing\"\n    fi\n  done\nfi\n```\n\n### Networking (4.x)\n\n```bash\n#!\u002Fbin\u002Fbash\n# cis-networking-checks.sh\n\necho \"=== CIS Networking Compliance Checks ===\"\n\n# 4.1: No security groups allow 0.0.0.0\u002F0 ingress to port 22\necho \"4.1: Checking SSH access (port 22)...\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[*].[GroupId,GroupName,IpPermissions]' \\\n  --output json | \\\njq -r '.[] | select(.[2][]? | \n  select(.FromPort == 22 and .IpRanges[]?.CidrIp == \"0.0.0.0\u002F0\")) | \n  \"  ⚠️  \\(.[0]): \\(.[1]) allows SSH from 0.0.0.0\u002F0\"'\n\n# 4.2: No security groups allow 0.0.0.0\u002F0 ingress to port 3389\necho \"4.2: Checking RDP access (port 3389)...\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[*].[GroupId,GroupName,IpPermissions]' \\\n  --output json | \\\njq -r '.[] | select(.[2][]? | \n  select(.FromPort == 3389 and .IpRanges[]?.CidrIp == \"0.0.0.0\u002F0\")) | \n  \"  ⚠️  \\(.[0]): \\(.[1]) allows RDP from 0.0.0.0\u002F0\"'\n\n# 4.3: Default security group restricts all traffic\necho \"4.3: Checking default security groups...\"\naws ec2 describe-security-groups \\\n  --filters Name=group-name,Values=default \\\n  --query 'SecurityGroups[*].[GroupId,IpPermissions,IpPermissionsEgress]' \\\n  --output json | \\\njq -r '.[] | select((.[1] | length) > 0 or (.[2] | length) > 1) | \n  \"  ⚠️  \\(.[0]): Default SG has rules\"'\n```\n\n## PCI-DSS Compliance Checks\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n# pci-dss-checker.py\n\nimport boto3\n\ndef check_pci_compliance():\n    \"\"\"Check PCI-DSS requirements\"\"\"\n    \n    ec2 = boto3.client('ec2')\n    rds = boto3.client('rds')\n    s3 = boto3.client('s3')\n    \n    issues = []\n    \n    # Requirement 1: Network security\n    sgs = ec2.describe_security_groups()\n    for sg in sgs['SecurityGroups']:\n        for perm in sg.get('IpPermissions', []):\n            for ip_range in perm.get('IpRanges', []):\n                if ip_range.get('CidrIp') == '0.0.0.0\u002F0':\n                    issues.append(f\"PCI 1.2: {sg['GroupId']} open to internet\")\n    \n    # Requirement 2: Secure configurations\n    # Check for default passwords, etc.\n    \n    # Requirement 3: Protect cardholder data\n    volumes = ec2.describe_volumes()\n    for vol in volumes['Volumes']:\n        if not vol['Encrypted']:\n            issues.append(f\"PCI 3.4: Volume {vol['VolumeId']} not encrypted\")\n    \n    # Requirement 4: Encrypt transmission\n    # Check for SSL\u002FTLS on load balancers\n    \n    # Requirement 8: Access controls\n    iam = boto3.client('iam')\n    users = iam.list_users()\n    for user in users['Users']:\n        mfa = iam.list_mfa_devices(UserName=user['UserName'])\n        if not mfa['MFADevices']:\n            issues.append(f\"PCI 8.3: {user['UserName']} no MFA\")\n    \n    # Requirement 10: Logging\n    cloudtrail = boto3.client('cloudtrail')\n    trails = cloudtrail.describe_trails()\n    if not trails['trailList']:\n        issues.append(\"PCI 10.1: No CloudTrail enabled\")\n    \n    return issues\n\nif __name__ == \"__main__\":\n    print(\"PCI-DSS Compliance Check\")\n    print(\"=\" * 50)\n    \n    issues = check_pci_compliance()\n    \n    if not issues:\n        print(\"✓ No PCI-DSS issues found\")\n    else:\n        print(f\"Found {len(issues)} issues:\\n\")\n        for issue in issues:\n            print(f\"  ⚠️  {issue}\")\n```\n\n## HIPAA Compliance Checks\n\n```bash\n#!\u002Fbin\u002Fbash\n# hipaa-checker.sh\n\necho \"=== HIPAA Compliance Checks ===\"\n\n# Access Controls (164.308(a)(3))\necho \"Access Controls:\"\naws iam get-credential-report --output text | \\\n  awk -F, 'NR>1 && $4==\"false\" {print \"  ⚠️  \" $1 \": No MFA (164.312(a)(2)(i))\"}'\n\n# Audit Controls (164.312(b))\necho \"\"\necho \"Audit Controls:\"\ntrails=$(aws cloudtrail describe-trails --query 'trailList[*].Name' --output text)\nif [ -z \"$trails\" ]; then\n  echo \"  ❌ No CloudTrail (164.312(b))\"\nelse\n  echo \"  ✓ CloudTrail enabled\"\nfi\n\n# Encryption (164.312(a)(2)(iv))\necho \"\"\necho \"Encryption at Rest:\"\naws ec2 describe-volumes \\\n  --query 'Volumes[?Encrypted==`false`].VolumeId' \\\n  --output text | \\\nwhile read vol; do\n  echo \"  ⚠️  $vol: Not encrypted (164.312(a)(2)(iv))\"\ndone\n\naws rds describe-db-instances \\\n  --query 'DBInstances[?StorageEncrypted==`false`].DBInstanceIdentifier' \\\n  --output text | \\\nwhile read db; do\n  echo \"  ⚠️  $db: Not encrypted (164.312(a)(2)(iv))\"\ndone\n\n# Transmission Security (164.312(e)(1))\necho \"\"\necho \"Transmission Security:\"\necho \"  Check: All data in transit uses TLS 1.2+\"\n```\n\n## Automated Compliance Reporting\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n# compliance-report.py\n\nimport boto3\nimport json\nfrom datetime import datetime\n\ndef generate_compliance_report(framework='cis'):\n    \"\"\"Generate comprehensive compliance report\"\"\"\n    \n    report = {\n        'framework': framework,\n        'generated': datetime.now().isoformat(),\n        'checks': [],\n        'summary': {\n            'total': 0,\n            'passed': 0,\n            'failed': 0,\n            'score': 0\n        }\n    }\n    \n    # Run all checks based on framework\n    if framework == 'cis':\n        checks = run_cis_checks()\n    elif framework == 'pci':\n        checks = run_pci_checks()\n    elif framework == 'hipaa':\n        checks = run_hipaa_checks()\n    \n    report['checks'] = checks\n    report['summary']['total'] = len(checks)\n    report['summary']['passed'] = sum(1 for c in checks if c['status'] == 'PASS')\n    report['summary']['failed'] = report['summary']['total'] - report['summary']['passed']\n    report['summary']['score'] = (report['summary']['passed'] \u002F report['summary']['total']) * 100\n    \n    return report\n\ndef run_cis_checks():\n    # Implement CIS checks\n    return []\n\ndef run_pci_checks():\n    # Implement PCI checks\n    return []\n\ndef run_hipaa_checks():\n    # Implement HIPAA checks\n    return []\n\nif __name__ == \"__main__\":\n    import sys\n    framework = sys.argv[1] if len(sys.argv) > 1 else 'cis'\n    \n    report = generate_compliance_report(framework)\n    \n    print(f\"\\n{framework.upper()} Compliance Report\")\n    print(\"=\" * 50)\n    print(f\"Score: {report['summary']['score']:.1f}%\")\n    print(f\"Passed: {report['summary']['passed']}\u002F{report['summary']['total']}\")\n    print(f\"Failed: {report['summary']['failed']}\u002F{report['summary']['total']}\")\n    \n    # Save to file\n    with open(f'compliance-{framework}-{datetime.now().strftime(\"%Y%m%d\")}.json', 'w') as f:\n        json.dump(report, f, indent=2)\n```\n\n## Example Prompts\n\n- \"Run CIS AWS Foundations compliance check\"\n- \"Generate a PCI-DSS compliance report\"\n- \"Check HIPAA compliance for my AWS account\"\n- \"Audit against SOC 2 requirements\"\n- \"Create a compliance dashboard\"\n\n## Best Practices\n\n- Run compliance checks weekly\n- Automate with Lambda\u002FEventBridge\n- Track compliance trends over time\n- Document exceptions with justification\n- Integrate with AWS Security Hub\n- Use AWS Config Rules for continuous monitoring\n\n## Kiro CLI Integration\n\n```bash\nkiro-cli chat \"Use aws-compliance-checker to run CIS benchmark\"\nkiro-cli chat \"Generate PCI-DSS report with aws-compliance-checker\"\n```\n\n## Additional Resources\n\n- [CIS AWS Foundations Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Famazon_web_services)\n- [AWS Security Hub](https:\u002F\u002Faws.amazon.com\u002Fsecurity-hub\u002F)\n- [AWS Compliance Programs](https:\u002F\u002Faws.amazon.com\u002Fcompliance\u002Fprograms\u002F)\n",{"name":5,"risk":40,"tags":46,"source":32,"category":39,"description":7},[27,25,38,34,28,36,29],"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Faws-compliance-checker",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill aws-compliance-checker",{"tool":62,"command":63},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill aws-compliance-checker",{"tool":65,"command":66},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill aws-compliance-checker","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Faws-compliance-checker\u002FSKILL.md",true,[70],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"skill-report.json","REFERENCE","参考文档",24383,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Faws-compliance-checker\u002Fskill-report.json",[77,91,101,110,116,123],{"skillNo":78,"name":79,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":87,"publishedAt":41},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[82],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[88,89,90],"model","model hierarchy","model hierarchy skill",{"skillNo":92,"name":93,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":97,"publishedAt":41},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[96],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},[98,99,100],"MCP","zoom","zoom mcp",{"skillNo":102,"name":103,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":41},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[107,108,109,99],"sdk","zoom apps sdk","apps",{"skillNo":111,"name":112,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":41},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[112],{"skillNo":117,"name":118,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":41},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[121],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},[118],{"skillNo":124,"name":125,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":41},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[125]]