skills.rest
imMamdouhaboammar
imMamdouhaboammarCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

agency-cloud-security-architect

Designs zero trust cloud architectures and secures infrastructure-as-code pipelines across AWS, Azure, and GCP.

Updated Jul 27, 2026
Search Tags:#compliance#kubernetes#terraform#iam#devsecops#cloud security#zero trust
One-click install
npx skills add https://github.com/imMamdouhaboammar/Mimera --skill agency-cloud-security-architect-immamdouhaboammar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-cloud-security-architect
Source: https://github.com/imMamdouhaboammar/Mimera/tree/main/.agents/skills/security-cloud-security-architect
Command: npx skills add https://github.com/imMamdouhaboammar/Mimera --skill agency-cloud-security-architect-immamdouhaboammar

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Cloud environments are frequently breached through IAM misconfigurations, exposed storage, and long-lived credentials. This Skill embeds security architecture expertise into your workflow so zero trust design, least-privilege IAM, and pipeline security checks are applied from day one rather than retrofitted after an incident. ## Core Features & Use Cases - Zero Trust Architecture Design: Produces network segmentation, identity-based access, mTLS service mesh, and data protection designs using VPCs, security groups, private endpoints, and Kubernetes NetworkPolicies. - Infrastructure-as-Code Security: Delivers Terraform implementations of AWS Organizations SCPs, centralized immutable logging, GuardDuty, and VPC Flow Logs, plus CI/CD pipelines with Checkov, Gitleaks, Trivy, and OIDC-based credentialless deployment. - Posture Assessment & Compliance: Provides a cloud security posture checklist covering IAM, network, data protection, logging, and compute aligned with CIS Benchmarks, NIST CSF, and SOC 2. - Use Case: Ask it to design a multi-account AWS security architecture, and it returns Terraform for organizational guardrails, centralized encrypted audit logging with object lock, threat detection, and a hardened GitHub Actions deployment pipeline. ## Quick Start Ask the agent to design a zero trust network and IAM architecture for your AWS or Kubernetes environment with Terraform and policy-as-code guardrails.

Frequently Asked Questions about agency-cloud-security-architect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I design a zero trust architecture on AWS?▼

Zero trust on AWS starts with a multi-account structure under AWS Organizations, SCPs denying root usage and unencrypted storage, and identity-based access via IAM roles instead of long-lived credentials. Add VPC Flow Logs, GuardDuty, and private endpoints so every request is authenticated, logged, and segmented.

How do I secure a CI/CD pipeline without storing AWS credentials?▼

Use OIDC federation in GitHub Actions with the configure-aws-credentials action to assume a short-lived IAM role, eliminating stored access keys. Combine this with Checkov for IaC scanning, Gitleaks for secret detection, and Trivy for container vulnerability checks that fail the pipeline on critical findings.

What Kubernetes NetworkPolicies enforce zero trust between pods?▼

Start with a default-deny-all NetworkPolicy for ingress and egress, then add explicit allow rules per workload, such as frontend to backend on port 8080 and backend to database on port 5432. Always include a DNS egress rule to kube-system so service discovery keeps working.

Does this approach work across Azure and GCP as well as AWS?▼

Yes, the same patterns map across providers: Azure Policies and GCP Organization Policies replace SCPs, managed identities and Workload Identity replace IRSA, and Defender for Cloud or Security Command Center replace GuardDuty. Provider-agnostic tools like OPA and Checkov enforce consistent policy everywhere.

Why should long-lived credentials never be used in cloud environments?▼

Long-lived credentials can be leaked through repos, logs, or compromised laptops and remain valid indefinitely, enabling breaches like the Capital One incident. IAM roles, workload identity, and OIDC federation issue short-lived tokens that expire quickly and tie every action to an audited identity.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

securing-azure-with-microsoft-defender

Deploy Defender for Cloud across Azure, AWS, and GCP to establish security posture baselines.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

auditing-terraform-infrastructure-for-security

Audit Terraform infrastructure for security misconfigurations across CI/CD pipelines.

Community
Advanced
xalgordxalgord
954

performing-threat-emulation-with-atomic-red-team

Executes Atomic Red Team tests to validate MITRE ATT&CK detection coverage.

Community
Intermediate
Muath2000Muath2000

network-scanner-engineer

Build and manage network scanning engines for asset discovery and vulnerability detection.

Community
Advanced