skills.rest
dgethings
dgethingsCOMMUNITY
Explore all skills by this author →
GitHub

aws-security-audit

Inspect IAM users, roles, policies, and CloudTrail events across AWS accounts.

Updated Feb 28, 2026
Search Tags:#aws#permissions#compliance#iam#mfa#security-audit#cloudtrail
One-click install
npx skills add https://github.com/dgethings/netclaw --skill aws-security-audit-dgethings
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-security-audit
Source: https://github.com/dgethings/netclaw/tree/main/workspace/skills/aws-security-audit
Command: npx skills add https://github.com/dgethings/netclaw --skill aws-security-audit-dgethings

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify gaps in AWS identity and access management, track API activity with CloudTrail, and assess overall security posture across AWS resources to support incident investigations, compliance checks, and access reviews.

Core Features & Use Cases

  • IAM inventory: enumerate users, roles, policies, and groups with MFA and last activity.
  • CloudTrail analytics: search events, filter by user, service, resource, and time window.
  • Compliance checks: MFA enforcement, unused keys, and policy risk identification.
  • Reporting: generate remediation-focused findings and recommendations.

Quick Start

Audit an AWS account by listing IAM users, roles, policies, and CloudTrail events, then generate a security posture report.

Frequently Asked Questions about aws-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit AWS IAM users and roles for compliance checks?▼

You can audit AWS security posture by inspecting IAM users, roles, policies, and CloudTrail events. The Skill enumerates identities, checks MFA enforcement, identifies unused keys, and generates remediation-focused findings for compliance checks.

How do I search CloudTrail events to investigate a security incident?▼

You can search CloudTrail events to investigate a security incident by filtering AWS API activity based on user, service, resource, and time window. The Skill queries CloudTrail analytics to track activity and assess overall AWS security posture.

Do I need specific AWS credentials to run a security audit across multiple accounts?▼

Yes, you need AWS credentials with read-only IAM and CloudTrail permissions to run the security audit. You must also configure your environment using AWS_REGION or AWS_PROFILE variables to inspect multiple AWS accounts and regions.

What is the best way to identify unused access keys and policy risks in AWS?▼

The best way to identify unused access keys and policy risks in AWS is to perform an IAM inventory that enumerates identities and checks last activity. The Skill flags unused keys and generates remediation-focused findings for policy risk identification.

Can I generate a security posture report across multiple AWS regions?▼

Yes, you can generate a security posture report across multiple AWS regions by running the audit with the appropriate region configuration. The Skill inspects IAM and CloudTrail data across regions to output remediation-focused findings and recommendations.

Related Skills

Explore More Legal & Compliance Skills→
automateyournetworkautomateyournetwork
627

aws-security-audit

Audits AWS IAM configurations and CloudTrail API events for compliance.

Community
Intermediate
AradotsoAradotso
11

sparkfinderoven-claude-security-compliance-suite

Scan code for OWASP issues, dependency CVEs, secrets, and IAM risks.

Official
Advanced
tomztomz

aws-security

Automates AWS security baselines and incident-response patterns across multi-account environments.

Community
Advanced
DCx7C5DCx7C5

cloud-SKILL.md

Aggregate cloud misconfigurations from AWS Security Hub, Azure Defender, and open-source tools.

Community
Advanced