aws-security-audit

Inspect IAM users, roles, policies, and CloudTrail events across AWS accounts.

Updated Feb 28, 2026

Search Tags:#aws #permissions #compliance #iam #mfa #security-audit #cloudtrail

Ready to run

npx skills add https://github.com/dgethings/netclaw --skill aws-security-audit-dgethings

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: aws-security-audit
Source: https://github.com/dgethings/netclaw/tree/main/workspace/skills/aws-security-audit
Command: npx skills add https://github.com/dgethings/netclaw --skill aws-security-audit-dgethings

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify gaps in AWS identity and access management, track API activity with CloudTrail, and assess overall security posture across AWS resources to support incident investigations, compliance checks, and access reviews.

Core Features & Use Cases

IAM inventory: enumerate users, roles, policies, and groups with MFA and last activity.
CloudTrail analytics: search events, filter by user, service, resource, and time window.
Compliance checks: MFA enforcement, unused keys, and policy risk identification.
Reporting: generate remediation-focused findings and recommendations.

Quick Start

Audit an AWS account by listing IAM users, roles, policies, and CloudTrail events, then generate a security posture report.

Frequently Asked Questions about aws-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit AWS IAM users and roles for compliance checks?▼

You can audit AWS security posture by inspecting IAM users, roles, policies, and CloudTrail events. The Skill enumerates identities, checks MFA enforcement, identifies unused keys, and generates remediation-focused findings for compliance checks.

How do I search CloudTrail events to investigate a security incident?▼

You can search CloudTrail events to investigate a security incident by filtering AWS API activity based on user, service, resource, and time window. The Skill queries CloudTrail analytics to track activity and assess overall AWS security posture.

Do I need specific AWS credentials to run a security audit across multiple accounts?▼

Yes, you need AWS credentials with read-only IAM and CloudTrail permissions to run the security audit. You must also configure your environment using AWS_REGION or AWS_PROFILE variables to inspect multiple AWS accounts and regions.

What is the best way to identify unused access keys and policy risks in AWS?▼

The best way to identify unused access keys and policy risks in AWS is to perform an IAM inventory that enumerates identities and checks last activity. The Skill flags unused keys and generates remediation-focused findings for policy risk identification.

Can I generate a security posture report across multiple AWS regions?▼

Yes, you can generate a security posture report across multiple AWS regions by running the audit with the appropriate region configuration. The Skill inspects IAM and CloudTrail data across regions to output remediation-focused findings and recommendations.