skills.rest
aws-samples
aws-samplesOFFICIAL
Explore all skills by this author →
WebsiteGitHub

aws-security-guard

Analyze AWS operation intents and infrastructure-as-code configurations for security risks.

6|Updated Jun 23, 2026
Search Tags:#security#aws#compliance#risk-assessment#infrastructure-as-code#cloud-security
One-click install
npx skills add https://github.com/aws-samples/sample-fsi-reference-architecture-jp --skill aws-security-guard
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-security-guard
Source: https://github.com/aws-samples/sample-fsi-reference-architecture-jp/tree/main/skills/aws-security-guard
Command: npx skills add https://github.com/aws-samples/sample-fsi-reference-architecture-jp --skill aws-security-guard

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill prevents accidental security misconfigurations in AWS environments by analyzing user requests for potential risks before any infrastructure changes are executed.

Core Features & Use Cases

  • Risk Detection: Identifies critical issues like public S3 buckets, overly permissive IAM policies, and unencrypted resources.
  • Decision Support: Provides clear explanations of risks and suggests secure alternatives to achieve the user's goal.
  • Use Case: When a user asks to create a new S3 bucket, the skill automatically checks if the configuration allows public access and warns the user if it does, suggesting a private configuration instead.

Quick Start

Use the aws-security-guard skill to analyze my planned CloudFormation template for potential security vulnerabilities before deployment.

Frequently Asked Questions about aws-security-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check infrastructure-as-code for security risks before deploying to AWS?▼

Security risks in AWS operation intents are detected by analyzing planned CLI commands and infrastructure-as-code configurations. The mechanism identifies network exposure, IAM over-privilege, and missing encryption, providing actionable remediation alternatives for the vulnerabilities found.

How do I scan a CloudFormation template for IAM over-privilege and missing encryption?▼

To scan a CloudFormation template, analyze the configuration against security governance requirements to identify overly permissive IAM policies and unencrypted resources. This process yields clear explanations of risks and suggests secure alternatives to achieve your goal.

Does this security analysis work with Terraform and AWS CDK deployment workflows?▼

Yes, this security analysis works with Terraform and AWS CDK deployment workflows, alongside AWS CLI commands and CloudFormation. It applies proactive security governance to these platforms by evaluating configurations for public S3 buckets and other compliance risks before changes are executed.

What's the best way to prevent accidental public S3 bucket creation during AWS operations?▼

A prerequisite for security risk detection is providing AWS operation intents or infrastructure-as-code configurations as input data. You need prepared CloudFormation, Terraform, CDK templates, or CLI commands to receive actionable remediation alternatives for vulnerabilities.

How do I get remediation suggestions for vulnerabilities detected in AWS infrastructure?▼

The next step after detecting security risks in AWS configurations is applying the suggested actionable remediation alternatives. Executing these secure alternatives resolves vulnerabilities like IAM over-privilege and missing encryption, achieving compliant infrastructure deployment.

Related Skills

Explore More Software Engineering Skills→
truongnattruongnat

aws-pro

Manage AWS infrastructure with Terraform or AWS CDK.

Community
Advanced
infraspecdevinfraspecdev
3

terraform-security-audit

Audit Terraform AWS infrastructure for security vulnerabilities and policy flaws.

Official
Advanced
thomast1906thomast1906
19

terraform-security-scan

Automate security scanning of Terraform configurations for Azure infrastructure.

Community
Advanced
oborchersoborchers
28

security-monitoring-from-day-one

Deploy managed cloud security services for threat detection and compliance scanning.

Community
Advanced