AWS Security Scanner

DevOps & Security

aws-security-scanner

AWS Security Scanner is an Agent Skill for devops & security published in the a5c-ai/babysitter repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

AWS security configuration scanning and hardening using Prowler, Security Hub, and AWS Config

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/a5c-ai/babysitter/blob/HEAD/library/specializations/security-compliance/skills/aws-security-scanner/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/aws-security-scanner, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

AWS Security Scanner Skill

Purpose

Automated AWS security configuration scanning and hardening to identify misconfigurations, compliance violations, and security risks across AWS accounts and organizations.

Capabilities

Prowler Security Assessments

Run comprehensive Prowler security scans
Execute CIS AWS Foundations Benchmark checks
Run AWS Well-Architected security pillar assessments
Check PCI DSS, HIPAA, GDPR compliance
Generate multi-format reports (HTML, CSV, JSON)

IAM Security Analysis

Analyze IAM policies for over-permissive access
Check for unused credentials and access keys
Identify IAM users without MFA
Review cross-account access configurations
Detect privilege escalation paths
Analyze service control policies (SCPs)

S3 Bucket Security

Identify publicly accessible buckets
Check bucket encryption configurations
Review bucket policies and ACLs
Verify access logging enabled
Check for sensitive data exposure
Validate versioning and replication

Network Security Analysis

Review security group configurations
Analyze Network ACLs
Check VPC flow log enablement
Identify public-facing resources
Validate VPC endpoint configurations
Check for overly permissive rules

Encryption Verification

Verify EBS volume encryption
Check RDS encryption settings
Validate S3 encryption configurations
Review KMS key policies
Check secrets manager configurations
Verify certificate validity

Logging and Monitoring

Validate CloudTrail configuration
Check CloudWatch log retention
Verify GuardDuty enablement
Review Security Hub findings
Check Config rule compliance
Validate alarm configurations

Compliance Mapping

Map findings to CIS Benchmarks
Generate SOC 2 evidence
Track PCI DSS compliance
Document HIPAA controls
Map to NIST frameworks

AWS Services Covered

Category	Services
Identity	IAM, SSO, Organizations
Compute	EC2, Lambda, ECS, EKS
Storage	S3, EBS, EFS, Glacier
Database	RDS, DynamoDB, Redshift
Network	VPC, CloudFront, Route53
Security	Security Hub, GuardDuty, KMS
Monitoring	CloudTrail, CloudWatch, Config

Integrations

Prowler: Open-source AWS security tool
AWS Security Hub: Centralized security findings
AWS Config: Configuration compliance
AWS CloudTrail: API activity logging
AWS GuardDuty: Threat detection
AWS IAM Access Analyzer: Access analysis

Target Processes

Cloud Security Architecture Review
Compliance Monitoring
Security Posture Assessment
AWS Account Hardening

Input Schema

{
  "type": "object",
  "properties": {
    "scanType": {
      "type": "string",
      "enum": ["full", "cis", "pci", "hipaa", "gdpr", "custom"],
      "description": "Type of security scan"
    },
    "awsAccounts": {
      "type": "array",
      "items": { "type": "string" },
      "description": "AWS account IDs to scan"
    },
    "regions": {
      "type": "array",
      "items": { "type": "string" },
      "description": "AWS regions to scan"
    },
    "services": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific services to scan"
    },
    "severityThreshold": {
      "type": "string",
      "enum": ["critical", "high", "medium", "low", "informational"]
    },
    "complianceFrameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["CIS", "PCI-DSS", "HIPAA", "GDPR", "SOC2", "NIST"]
      }
    },
    "excludeChecks": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Check IDs to exclude"
    }
  },
  "required": ["scanType"]
}

Output Schema

{
  "type": "object",
  "properties": {
    "scanId": {
      "type": "string"
    },
    "scanTimestamp": {
      "type": "string",
      "format": "date-time"
    },
    "accountsScanned": {
      "type": "array"
    },
    "regionsScanned": {
      "type": "array"
    },
    "summary": {
      "type": "object",
      "properties": {
        "totalChecks": { "type": "integer" },
        "passed": { "type": "integer" },
        "failed": { "type": "integer" },
        "warnings": { "type": "integer" }
      }
    },
    "findingsBySeverity": {
      "type": "object",
      "properties": {
        "critical": { "type": "integer" },
        "high": { "type": "integer" },
        "medium": { "type": "integer" },
        "low": { "type": "integer" }
      }
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "checkId": { "type": "string" },
          "severity": { "type": "string" },
          "service": { "type": "string" },
          "region": { "type": "string" },
          "resourceId": { "type": "string" },
          "description": { "type": "string" },
          "remediation": { "type": "string" },
          "complianceMapping": { "type": "array" }
        }
      }
    },
    "complianceStatus": {
      "type": "object"
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    },
    "reportPaths": {
      "type": "object",
      "properties": {
        "html": { "type": "string" },
        "csv": { "type": "string" },
        "json": { "type": "string" }
      }
    }
  }
}

Usage Example

skill: {
  name: 'aws-security-scanner',
  context: {
    scanType: 'cis',
    awsAccounts: ['123456789012'],
    regions: ['us-east-1', 'us-west-2'],
    complianceFrameworks: ['CIS', 'SOC2'],
    severityThreshold: 'medium'
  }
}