Cloud Misconfiguration Review and Hardening
Reviews your AWS, Azure, or GCP configs and IaC for risky misconfigurations and returns ranked findings with exact fix diffs.
Before & after
Same prompt, same agent — the only difference is the skill.
You should review your AWS infrastructure for common security issues. This would involve checking things like IAM policies for overly permissive rules, S3 buckets for public exposure, security groups for open access, and encryption settings. You might also look at your Infrastructure as Code for security gaps. A comprehensive assessment would involve multiple checks across different AWS services. Do you have any specific concerns about your current setup, or should we start with a general review?
AWS SECURITY AUDIT FINDINGS REPORT CRITICAL ISSUES (fix immediately): 1. S3 BUCKET EXPOSED (bucket-prod-assets-2026) Finding: Public read access enabled (ACL = public-read). Any internet user can list and download 14.2 GB of data including API keys in config files. MITRE ATT&CK: T1526 (cloud service discovery) → T1530 (data from cloud storage). Remediation: 1) Remove public ACL immediately. 2) Enable S3 Block Public Access (all four options). 3) Scan bucket contents for secrets (regex scan for "AKIA" prefixes). 4) Rotate any exposed credentials. Time: 1 hour. 2. RDS DATABASE SECURITY GROUP (rds-sg-prod) Finding: MySQL port 3306 open to 0.0.0.0/0 (entire internet). Brute-force attacks possible. MITRE ATT&CK: T1190 (exploit public-facing app) → T1110 (credential enumeration). Remediation: Restrict to application security group only (sg-app-layer). Remove 0.0.0.0/0 rule. Time: 15 minutes. 3. IAM ROLE OVER-PROVISIONED (lambda-execution-role) Finding: Lambda role has "s3:*" on resource "*". Allows read/write/delete ALL buckets (should be specific bucket + prefix). 14 Lambda functions inherit this role. MITRE ATT&CK: T1078 (valid accounts) → T1537 (transfer data to cloud account). Remediation: Create fine-grained role per Lambda (minimal principle). Specify exact bucket and object prefixes. Time: 3 hours. HIGH-PRIORITY ISSUES (fix within 7 days): 4. CLOUDTRAIL NOT LOGGING (not enabled) Issue: API calls unaudited. Cannot investigate incidents. Compliance risk (SOC 2 requires audit trail). Remediation: Enable CloudTrail. Log to S3 with MFA-delete enabled. Time: 1 hour. 5. ROOT ACCOUNT MFA NOT ENFORCED Issue: Root AWS account has no MFA. Single compromised password = full AWS account takeover. Remediation: Enable MFA on root account (hardware key preferred). Never use root except account recovery. Time: 30 minutes. MEDIUM-PRIORITY (30-day fix): 6. SECRETS STORED IN ENVIRONMENT VARIABLES Finding: Database passwords, API keys stored as plaintext in Lambda environment. Readable by any function with lambda:GetFunction permission. Remediation: Migrate to AWS Secrets Manager. Rotate credentials. Time: 2 days. MITRE ATT&CK MAPPING (risk prioritization): Initial Access (T1190): RDS exposed → Exploitation (T1110): Brute-force DB. Privilege Escalation (T1078): Over-provisioned Lambda role → Lateral movement to S3. Exfiltration (T1537): S3 public + Secrets in env vars = data leak vector. 30-DAY ROADMAP: Week 1: Fix critical issues (S3, RDS, IAM). Enable CloudTrail. Week 2: Secrets rotation. Week 3: Implement VPC endpoint for S3 (blocks internet access). Week 4: Audit complete, retest all findings. ESTIMATED EFFORT: 16 hours total. Cost to ignore: $480k potential breach recovery + compliance fine.
About this skill
Your scanner just produced 400 findings and you can't tell which three actually matter. Or you're about to apply a Terraform plan and want to know whether it opens a bucket, a port, or an admin path. This skill reviews the policies, plans, and configs you paste in, ranks what is actually reachable and damaging, and hands back the fix as a diff you can merge.
What it does
- Ranks findings by exposure, blast radius, and ease of abuse instead of copying scanner severity labels
- Reviews IAM policies, role trust policies, and Azure or GCP role bindings for over-broad grants and self-escalation risk, then returns a narrowed policy
- Checks storage for public access across every layer (account block, bucket policy, ACLs, signed URLs) instead of stopping at one setting
- Audits security groups, NSGs, and firewall rules for internet ingress on admin and database ports, including rules hidden in shared modules
- Reviews Terraform, CloudFormation, Bicep, and Pulumi before apply for hardcoded secrets, missing encryption, and logging gaps
- Adds detection and guardrail recommendations (org policies, SCPs, Azure Policy) so the same mistake can't come back
What you get
A ranked findings table with evidence, impact, and a concrete fix (policy diff, IaC patch, or CLI change) for each item, plus the preventive guardrail that stops it from recurring.
Best for
Platform and DevOps engineers, startup CTOs without a dedicated security team, and security engineers triaging cloud scanner output or gating IaC changes in review.
SKILL.md preview
---
name: cloud-misconfiguration-review-hardening
description: Reviews AWS, Azure, and GCP configurations and infrastructure-as-code for security misconfigurations, ranks findings by real exposure and blast radius, and returns least-privilege fixes as policy diffs or IaC patches plus preventive guardrails. Use when the user says "review this IAM policy", "is this bucket public", "security check this Terraform plan before I apply", "our scanner flagged 300 things, what actually matters", "lock down this security group", "my role keeps getting AccessDenied after I tightened it", or "harden our AWS account before the audit".
---
# Cloud Misconfiguration Review and Hardening
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.