[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EXCYX0CBAY7RARXGFRKM8N":3,"skill-same:01M6EXCYX0CBAY7RARXGFRKM8N":77},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M6EXCYX0CBAY7RARXGFRKM8N","aws-security-audit",null,"Comprehensive AWS security posture assessment using AWS CLI and security best practices","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Faws-security-audit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"security","aws security audit","audit","aws","security audit","aws security","kiro-cli","cli","kiro","security posture","community","aws cli","security-assessment","compliance","security best practices","best practices","assessment","safe","2026-11-10 10:12:30",false,"---\nname: aws-security-audit\ndescription: Comprehensive AWS security posture assessment using AWS CLI and security best practices\nrisk: safe\nsource: community\ncategory: security\ntags: [aws, security, audit, compliance, kiro-cli, security-assessment]\n---\n\n# AWS Security Audit\n\nPerform comprehensive security assessments of AWS environments to identify vulnerabilities and misconfigurations.\n\n## When to Use\n\nUse this skill when you need to audit AWS security posture, identify vulnerabilities, or prepare for compliance assessments.\n\n## Audit Categories\n\n**Identity & Access Management**\n- Overly permissive IAM policies\n- Unused IAM users and roles\n- MFA enforcement gaps\n- Root account usage\n- Access key rotation\n\n**Network Security**\n- Open security groups (0.0.0.0\u002F0)\n- Public S3 buckets\n- Unencrypted data in transit\n- VPC flow logs disabled\n- Network ACL misconfigurations\n\n**Data Protection**\n- Unencrypted EBS volumes\n- Unencrypted RDS instances\n- S3 bucket encryption disabled\n- Backup policies missing\n- KMS key rotation disabled\n\n**Logging & Monitoring**\n- CloudTrail disabled\n- CloudWatch alarms missing\n- VPC Flow Logs disabled\n- S3 access logging disabled\n- Config recording disabled\n\n## Security Audit Commands\n\n### IAM Security Checks\n\n```bash\n# List users without MFA\naws iam get-credential-report --output text | \\\n  awk -F, '$4==\"false\" && $1!=\"\u003Croot_account>\" {print $1}'\n\n# Find unused IAM users (no activity in 90 days)\naws iam list-users --query 'Users[*].[UserName]' --output text | \\\nwhile read user; do\n  last_used=$(aws iam get-user --user-name \"$user\" \\\n    --query 'User.PasswordLastUsed' --output text)\n  echo \"$user: $last_used\"\ndone\n\n# List overly permissive policies (AdministratorAccess)\naws iam list-policies --scope Local \\\n  --query 'Policies[?PolicyName==`AdministratorAccess`]'\n\n# Find access keys older than 90 days\naws iam list-users --query 'Users[*].UserName' --output text | \\\nwhile read user; do\n  aws iam list-access-keys --user-name \"$user\" \\\n    --query 'AccessKeyMetadata[*].[AccessKeyId,CreateDate]' \\\n    --output text\ndone\n\n# Check root account access keys\naws iam get-account-summary \\\n  --query 'SummaryMap.AccountAccessKeysPresent'\n```\n\n### Network Security Checks\n\n```bash\n# Find security groups open to the world\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0\u002F0`]]].[GroupId,GroupName]' \\\n  --output table\n\n# List public S3 buckets\naws s3api list-buckets --query 'Buckets[*].Name' --output text | \\\nwhile read bucket; do\n  acl=$(aws s3api get-bucket-acl --bucket \"$bucket\" 2>\u002Fdev\u002Fnull)\n  if echo \"$acl\" | grep -q \"AllUsers\"; then\n    echo \"PUBLIC: $bucket\"\n  fi\ndone\n\n# Check VPC Flow Logs status\naws ec2 describe-vpcs --query 'Vpcs[*].VpcId' --output text | \\\nwhile read vpc; do\n  flow_logs=$(aws ec2 describe-flow-logs \\\n    --filter \"Name=resource-id,Values=$vpc\" \\\n    --query 'FlowLogs[*].FlowLogId' --output text)\n  if [ -z \"$flow_logs\" ]; then\n    echo \"No flow logs: $vpc\"\n  fi\ndone\n\n# Find RDS instances without encryption\naws rds describe-db-instances \\\n  --query 'DBInstances[?StorageEncrypted==`false`].[DBInstanceIdentifier]' \\\n  --output table\n```\n\n### Data Protection Checks\n\n```bash\n# Find unencrypted EBS volumes\naws ec2 describe-volumes \\\n  --query 'Volumes[?Encrypted==`false`].[VolumeId,Size,State]' \\\n  --output table\n\n# Check S3 bucket encryption\naws s3api list-buckets --query 'Buckets[*].Name' --output text | \\\nwhile read bucket; do\n  encryption=$(aws s3api get-bucket-encryption \\\n    --bucket \"$bucket\" 2>&1)\n  if echo \"$encryption\" | grep -q \"ServerSideEncryptionConfigurationNotFoundError\"; then\n    echo \"No encryption: $bucket\"\n  fi\ndone\n\n# Find RDS snapshots that are public\naws rds describe-db-snapshots \\\n  --query 'DBSnapshots[*].[DBSnapshotIdentifier]' --output text | \\\nwhile read snapshot; do\n  attrs=$(aws rds describe-db-snapshot-attributes \\\n    --db-snapshot-identifier \"$snapshot\" \\\n    --query 'DBSnapshotAttributesResult.DBSnapshotAttributes[?AttributeName==`restore`].AttributeValues' \\\n    --output text)\n  if echo \"$attrs\" | grep -q \"all\"; then\n    echo \"PUBLIC SNAPSHOT: $snapshot\"\n  fi\ndone\n\n# Check KMS key rotation\naws kms list-keys --query 'Keys[*].KeyId' --output text | \\\nwhile read key; do\n  rotation=$(aws kms get-key-rotation-status --key-id \"$key\" \\\n    --query 'KeyRotationEnabled' --output text 2>\u002Fdev\u002Fnull)\n  if [ \"$rotation\" = \"False\" ]; then\n    echo \"Rotation disabled: $key\"\n  fi\ndone\n```\n\n### Logging & Monitoring Checks\n\n```bash\n# Check CloudTrail status\naws cloudtrail describe-trails \\\n  --query 'trailList[*].[Name,IsMultiRegionTrail,LogFileValidationEnabled]' \\\n  --output table\n\n# Verify CloudTrail is logging\naws cloudtrail get-trail-status --name my-trail \\\n  --query 'IsLogging'\n\n# Check if AWS Config is enabled\naws configservice describe-configuration-recorders \\\n  --query 'ConfigurationRecorders[*].[name,roleARN]' \\\n  --output table\n\n# List S3 buckets without access logging\naws s3api list-buckets --query 'Buckets[*].Name' --output text | \\\nwhile read bucket; do\n  logging=$(aws s3api get-bucket-logging --bucket \"$bucket\" 2>&1)\n  if ! echo \"$logging\" | grep -q \"LoggingEnabled\"; then\n    echo \"No access logging: $bucket\"\n  fi\ndone\n```\n\n## Automated Security Audit Script\n\n```bash\n#!\u002Fbin\u002Fbash\n# comprehensive-security-audit.sh\n\necho \"=== AWS Security Audit Report ===\"\necho \"Generated: $(date)\"\necho \"\"\n\n# IAM Checks\necho \"## IAM Security\"\necho \"Users without MFA:\"\naws iam get-credential-report --output text | \\\n  awk -F, '$4==\"false\" && $1!=\"\u003Croot_account>\" {print \"  - \" $1}'\n\necho \"\"\necho \"Root account access keys:\"\naws iam get-account-summary \\\n  --query 'SummaryMap.AccountAccessKeysPresent' --output text\n\n# Network Checks\necho \"\"\necho \"## Network Security\"\necho \"Security groups open to 0.0.0.0\u002F0:\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0\u002F0`]]].GroupId' \\\n  --output text | wc -l\n\n# Data Protection\necho \"\"\necho \"## Data Protection\"\necho \"Unencrypted EBS volumes:\"\naws ec2 describe-volumes \\\n  --query 'Volumes[?Encrypted==`false`].VolumeId' \\\n  --output text | wc -l\n\necho \"\"\necho \"Unencrypted RDS instances:\"\naws rds describe-db-instances \\\n  --query 'DBInstances[?StorageEncrypted==`false`].DBInstanceIdentifier' \\\n  --output text | wc -l\n\n# Logging\necho \"\"\necho \"## Logging & Monitoring\"\necho \"CloudTrail status:\"\naws cloudtrail describe-trails \\\n  --query 'trailList[*].[Name,IsLogging]' \\\n  --output table\n\necho \"\"\necho \"=== End of Report ===\"\n```\n\n## Security Score Calculator\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n# security-score.py\n\nimport boto3\nimport json\n\ndef calculate_security_score():\n    iam = boto3.client('iam')\n    ec2 = boto3.client('ec2')\n    s3 = boto3.client('s3')\n    \n    score = 100\n    issues = []\n    \n    # Check MFA\n    try:\n        report = iam.get_credential_report()\n        users_without_mfa = 0\n        # Parse report and count\n        if users_without_mfa > 0:\n            score -= 10\n            issues.append(f\"{users_without_mfa} users without MFA\")\n    except:\n        pass\n    \n    # Check open security groups\n    sgs = ec2.describe_security_groups()\n    open_sgs = 0\n    for sg in sgs['SecurityGroups']:\n        for perm in sg.get('IpPermissions', []):\n            for ip_range in perm.get('IpRanges', []):\n                if ip_range.get('CidrIp') == '0.0.0.0\u002F0':\n                    open_sgs += 1\n                    break\n    \n    if open_sgs > 0:\n        score -= 15\n        issues.append(f\"{open_sgs} security groups open to internet\")\n    \n    # Check unencrypted volumes\n    volumes = ec2.describe_volumes()\n    unencrypted = sum(1 for v in volumes['Volumes'] if not v['Encrypted'])\n    \n    if unencrypted > 0:\n        score -= 20\n        issues.append(f\"{unencrypted} unencrypted EBS volumes\")\n    \n    print(f\"Security Score: {score}\u002F100\")\n    print(\"\\nIssues Found:\")\n    for issue in issues:\n        print(f\"  - {issue}\")\n    \n    return score\n\nif __name__ == \"__main__\":\n    calculate_security_score()\n```\n\n## Compliance Mapping\n\n**CIS AWS Foundations Benchmark**\n- 1.1: Root account usage\n- 1.2-1.14: IAM policies and MFA\n- 2.1-2.9: Logging (CloudTrail, Config, VPC Flow Logs)\n- 4.1-4.3: Monitoring and alerting\n\n**PCI-DSS**\n- Requirement 1: Network security controls\n- Requirement 2: Secure configurations\n- Requirement 8: Access controls and MFA\n- Requirement 10: Logging and monitoring\n\n**HIPAA**\n- Access controls (IAM)\n- Audit controls (CloudTrail)\n- Encryption (EBS, RDS, S3)\n- Transmission security (TLS\u002FSSL)\n\n## Remediation Priorities\n\n**Critical (Fix Immediately)**\n- Root account access keys\n- Public RDS snapshots\n- Security groups open to 0.0.0.0\u002F0 on sensitive ports\n- CloudTrail disabled\n\n**High (Fix Within 7 Days)**\n- Users without MFA\n- Unencrypted data at rest\n- Missing VPC Flow Logs\n- Overly permissive IAM policies\n\n**Medium (Fix Within 30 Days)**\n- Old access keys (>90 days)\n- Missing S3 access logging\n- Unused IAM users\n- KMS key rotation disabled\n\n## Example Prompts\n\n- \"Run a comprehensive security audit on my AWS account\"\n- \"Check for IAM security issues\"\n- \"Find all unencrypted resources\"\n- \"Generate a security compliance report\"\n- \"Calculate my AWS security score\"\n\n## Best Practices\n\n- Run audits weekly\n- Automate with Lambda\u002FEventBridge\n- Export results to S3 for trending\n- Integrate with SIEM tools\n- Track remediation progress\n- Document exceptions with business justification\n\n## Kiro CLI Integration\n\n```bash\nkiro-cli chat \"Use aws-security-audit to assess my security posture\"\nkiro-cli chat \"Generate a security audit report with aws-security-audit\"\n```\n\n## Additional Resources\n\n- [AWS Security Best Practices](https:\u002F\u002Faws.amazon.com\u002Fsecurity\u002Fbest-practices\u002F)\n- [CIS AWS Foundations Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Famazon_web_services)\n- [AWS Security Hub](https:\u002F\u002Faws.amazon.com\u002Fsecurity-hub\u002F)\n","# AWS Security Audit\n\nPerform comprehensive security assessments of AWS environments to identify vulnerabilities and misconfigurations.\n\n## When to Use\n\nUse this skill when you need to audit AWS security posture, identify vulnerabilities, or prepare for compliance assessments.\n\n## Audit Categories\n\n**Identity & Access Management**\n- Overly permissive IAM policies\n- Unused IAM users and roles\n- MFA enforcement gaps\n- Root account usage\n- Access key rotation\n\n**Network Security**\n- Open security groups (0.0.0.0\u002F0)\n- Public S3 buckets\n- Unencrypted data in transit\n- VPC flow logs disabled\n- Network ACL misconfigurations\n\n**Data Protection**\n- Unencrypted EBS volumes\n- Unencrypted RDS instances\n- S3 bucket encryption disabled\n- Backup policies missing\n- KMS key rotation disabled\n\n**Logging & Monitoring**\n- CloudTrail disabled\n- CloudWatch alarms missing\n- VPC Flow Logs disabled\n- S3 access logging disabled\n- Config recording disabled\n\n## Security Audit Commands\n\n### IAM Security Checks\n\n```bash\n# List users without MFA\naws iam get-credential-report --output text | \\\n  awk -F, '$4==\"false\" && $1!=\"\u003Croot_account>\" {print $1}'\n\n# Find unused IAM users (no activity in 90 days)\naws iam list-users --query 'Users[*].[UserName]' --output text | \\\nwhile read user; do\n  last_used=$(aws iam get-user --user-name \"$user\" \\\n    --query 'User.PasswordLastUsed' --output text)\n  echo \"$user: $last_used\"\ndone\n\n# List overly permissive policies (AdministratorAccess)\naws iam list-policies --scope Local \\\n  --query 'Policies[?PolicyName==`AdministratorAccess`]'\n\n# Find access keys older than 90 days\naws iam list-users --query 'Users[*].UserName' --output text | \\\nwhile read user; do\n  aws iam list-access-keys --user-name \"$user\" \\\n    --query 'AccessKeyMetadata[*].[AccessKeyId,CreateDate]' \\\n    --output text\ndone\n\n# Check root account access keys\naws iam get-account-summary \\\n  --query 'SummaryMap.AccountAccessKeysPresent'\n```\n\n### Network Security Checks\n\n```bash\n# Find security groups open to the world\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0\u002F0`]]].[GroupId,GroupName]' \\\n  --output table\n\n# List public S3 buckets\naws s3api list-buckets --query 'Buckets[*].Name' --output text | \\\nwhile read bucket; do\n  acl=$(aws s3api get-bucket-acl --bucket \"$bucket\" 2>\u002Fdev\u002Fnull)\n  if echo \"$acl\" | grep -q \"AllUsers\"; then\n    echo \"PUBLIC: $bucket\"\n  fi\ndone\n\n# Check VPC Flow Logs status\naws ec2 describe-vpcs --query 'Vpcs[*].VpcId' --output text | \\\nwhile read vpc; do\n  flow_logs=$(aws ec2 describe-flow-logs \\\n    --filter \"Name=resource-id,Values=$vpc\" \\\n    --query 'FlowLogs[*].FlowLogId' --output text)\n  if [ -z \"$flow_logs\" ]; then\n    echo \"No flow logs: $vpc\"\n  fi\ndone\n\n# Find RDS instances without encryption\naws rds describe-db-instances \\\n  --query 'DBInstances[?StorageEncrypted==`false`].[DBInstanceIdentifier]' \\\n  --output table\n```\n\n### Data Protection Checks\n\n```bash\n# Find unencrypted EBS volumes\naws ec2 describe-volumes \\\n  --query 'Volumes[?Encrypted==`false`].[VolumeId,Size,State]' \\\n  --output table\n\n# Check S3 bucket encryption\naws s3api list-buckets --query 'Buckets[*].Name' --output text | \\\nwhile read bucket; do\n  encryption=$(aws s3api get-bucket-encryption \\\n    --bucket \"$bucket\" 2>&1)\n  if echo \"$encryption\" | grep -q \"ServerSideEncryptionConfigurationNotFoundError\"; then\n    echo \"No encryption: $bucket\"\n  fi\ndone\n\n# Find RDS snapshots that are public\naws rds describe-db-snapshots \\\n  --query 'DBSnapshots[*].[DBSnapshotIdentifier]' --output text | \\\nwhile read snapshot; do\n  attrs=$(aws rds describe-db-snapshot-attributes \\\n    --db-snapshot-identifier \"$snapshot\" \\\n    --query 'DBSnapshotAttributesResult.DBSnapshotAttributes[?AttributeName==`restore`].AttributeValues' \\\n    --output text)\n  if echo \"$attrs\" | grep -q \"all\"; then\n    echo \"PUBLIC SNAPSHOT: $snapshot\"\n  fi\ndone\n\n# Check KMS key rotation\naws kms list-keys --query 'Keys[*].KeyId' --output text | \\\nwhile read key; do\n  rotation=$(aws kms get-key-rotation-status --key-id \"$key\" \\\n    --query 'KeyRotationEnabled' --output text 2>\u002Fdev\u002Fnull)\n  if [ \"$rotation\" = \"False\" ]; then\n    echo \"Rotation disabled: $key\"\n  fi\ndone\n```\n\n### Logging & Monitoring Checks\n\n```bash\n# Check CloudTrail status\naws cloudtrail describe-trails \\\n  --query 'trailList[*].[Name,IsMultiRegionTrail,LogFileValidationEnabled]' \\\n  --output table\n\n# Verify CloudTrail is logging\naws cloudtrail get-trail-status --name my-trail \\\n  --query 'IsLogging'\n\n# Check if AWS Config is enabled\naws configservice describe-configuration-recorders \\\n  --query 'ConfigurationRecorders[*].[name,roleARN]' \\\n  --output table\n\n# List S3 buckets without access logging\naws s3api list-buckets --query 'Buckets[*].Name' --output text | \\\nwhile read bucket; do\n  logging=$(aws s3api get-bucket-logging --bucket \"$bucket\" 2>&1)\n  if ! echo \"$logging\" | grep -q \"LoggingEnabled\"; then\n    echo \"No access logging: $bucket\"\n  fi\ndone\n```\n\n## Automated Security Audit Script\n\n```bash\n#!\u002Fbin\u002Fbash\n# comprehensive-security-audit.sh\n\necho \"=== AWS Security Audit Report ===\"\necho \"Generated: $(date)\"\necho \"\"\n\n# IAM Checks\necho \"## IAM Security\"\necho \"Users without MFA:\"\naws iam get-credential-report --output text | \\\n  awk -F, '$4==\"false\" && $1!=\"\u003Croot_account>\" {print \"  - \" $1}'\n\necho \"\"\necho \"Root account access keys:\"\naws iam get-account-summary \\\n  --query 'SummaryMap.AccountAccessKeysPresent' --output text\n\n# Network Checks\necho \"\"\necho \"## Network Security\"\necho \"Security groups open to 0.0.0.0\u002F0:\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0\u002F0`]]].GroupId' \\\n  --output text | wc -l\n\n# Data Protection\necho \"\"\necho \"## Data Protection\"\necho \"Unencrypted EBS volumes:\"\naws ec2 describe-volumes \\\n  --query 'Volumes[?Encrypted==`false`].VolumeId' \\\n  --output text | wc -l\n\necho \"\"\necho \"Unencrypted RDS instances:\"\naws rds describe-db-instances \\\n  --query 'DBInstances[?StorageEncrypted==`false`].DBInstanceIdentifier' \\\n  --output text | wc -l\n\n# Logging\necho \"\"\necho \"## Logging & Monitoring\"\necho \"CloudTrail status:\"\naws cloudtrail describe-trails \\\n  --query 'trailList[*].[Name,IsLogging]' \\\n  --output table\n\necho \"\"\necho \"=== End of Report ===\"\n```\n\n## Security Score Calculator\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n# security-score.py\n\nimport boto3\nimport json\n\ndef calculate_security_score():\n    iam = boto3.client('iam')\n    ec2 = boto3.client('ec2')\n    s3 = boto3.client('s3')\n    \n    score = 100\n    issues = []\n    \n    # Check MFA\n    try:\n        report = iam.get_credential_report()\n        users_without_mfa = 0\n        # Parse report and count\n        if users_without_mfa > 0:\n            score -= 10\n            issues.append(f\"{users_without_mfa} users without MFA\")\n    except:\n        pass\n    \n    # Check open security groups\n    sgs = ec2.describe_security_groups()\n    open_sgs = 0\n    for sg in sgs['SecurityGroups']:\n        for perm in sg.get('IpPermissions', []):\n            for ip_range in perm.get('IpRanges', []):\n                if ip_range.get('CidrIp') == '0.0.0.0\u002F0':\n                    open_sgs += 1\n                    break\n    \n    if open_sgs > 0:\n        score -= 15\n        issues.append(f\"{open_sgs} security groups open to internet\")\n    \n    # Check unencrypted volumes\n    volumes = ec2.describe_volumes()\n    unencrypted = sum(1 for v in volumes['Volumes'] if not v['Encrypted'])\n    \n    if unencrypted > 0:\n        score -= 20\n        issues.append(f\"{unencrypted} unencrypted EBS volumes\")\n    \n    print(f\"Security Score: {score}\u002F100\")\n    print(\"\\nIssues Found:\")\n    for issue in issues:\n        print(f\"  - {issue}\")\n    \n    return score\n\nif __name__ == \"__main__\":\n    calculate_security_score()\n```\n\n## Compliance Mapping\n\n**CIS AWS Foundations Benchmark**\n- 1.1: Root account usage\n- 1.2-1.14: IAM policies and MFA\n- 2.1-2.9: Logging (CloudTrail, Config, VPC Flow Logs)\n- 4.1-4.3: Monitoring and alerting\n\n**PCI-DSS**\n- Requirement 1: Network security controls\n- Requirement 2: Secure configurations\n- Requirement 8: Access controls and MFA\n- Requirement 10: Logging and monitoring\n\n**HIPAA**\n- Access controls (IAM)\n- Audit controls (CloudTrail)\n- Encryption (EBS, RDS, S3)\n- Transmission security (TLS\u002FSSL)\n\n## Remediation Priorities\n\n**Critical (Fix Immediately)**\n- Root account access keys\n- Public RDS snapshots\n- Security groups open to 0.0.0.0\u002F0 on sensitive ports\n- CloudTrail disabled\n\n**High (Fix Within 7 Days)**\n- Users without MFA\n- Unencrypted data at rest\n- Missing VPC Flow Logs\n- Overly permissive IAM policies\n\n**Medium (Fix Within 30 Days)**\n- Old access keys (>90 days)\n- Missing S3 access logging\n- Unused IAM users\n- KMS key rotation disabled\n\n## Example Prompts\n\n- \"Run a comprehensive security audit on my AWS account\"\n- \"Check for IAM security issues\"\n- \"Find all unencrypted resources\"\n- \"Generate a security compliance report\"\n- \"Calculate my AWS security score\"\n\n## Best Practices\n\n- Run audits weekly\n- Automate with Lambda\u002FEventBridge\n- Export results to S3 for trending\n- Integrate with SIEM tools\n- Track remediation progress\n- Document exceptions with business justification\n\n## Kiro CLI Integration\n\n```bash\nkiro-cli chat \"Use aws-security-audit to assess my security posture\"\nkiro-cli chat \"Generate a security audit report with aws-security-audit\"\n```\n\n## Additional Resources\n\n- [AWS Security Best Practices](https:\u002F\u002Faws.amazon.com\u002Fsecurity\u002Fbest-practices\u002F)\n- [CIS AWS Foundations Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Famazon_web_services)\n- [AWS Security Hub](https:\u002F\u002Faws.amazon.com\u002Fsecurity-hub\u002F)\n",{"name":5,"risk":41,"tags":47,"source":34,"category":24,"description":7},[27,24,26,37,30,36],"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Faws-security-audit",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill aws-security-audit",{"tool":63,"command":64},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill aws-security-audit",{"tool":66,"command":67},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill aws-security-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Faws-security-audit\u002FSKILL.md",true,[71],{"path":72,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"skill-report.json","REFERENCE","参考文档",8954,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Faws-security-audit\u002Fskill-report.json",[78,92,102,111,117,124],{"skillNo":79,"name":80,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":88,"publishedAt":42},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[83],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[89,90,91],"model","model hierarchy","model hierarchy skill",{"skillNo":93,"name":94,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":98,"publishedAt":42},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[97],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},[99,100,101],"MCP","zoom","zoom mcp",{"skillNo":103,"name":104,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":42},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[108,109,110,100],"sdk","zoom apps sdk","apps",{"skillNo":112,"name":113,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":42},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[113],{"skillNo":118,"name":119,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":42},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[122],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},[119],{"skillNo":125,"name":126,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":42},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[126]]