cross-account

Multi-account AWS security auditing is automated by iterating a single-account audit pipeline across each enabled account. The Skill switches credentials, validates identity, and independently runs pre-flights, suppression scoping, and findings collection per account before consolidating output.

Multi-account AWS auditing supports profile, assume_role, and environment credential modes. Each account entry in accounts.yaml can specify an aws_profile or role_arn, allowing the audit pipeline to execute with the correct identity and maintain credential isolation between accounts.

Cross-account AWS auditing requires a validated config/accounts.yaml file. You must define your enabled account list with either an aws_profile or role_arn per entry so the audit workflow can iterate through each account with the appropriate credentials and enforcement guardrails.

Account-scoped suppression scoping is supported during multi-account AWS auditing. When specified in the configuration, suppressions are scoped by account, ensuring findings collection and audit guardrails remain isolated to the correct identity context during sequential iteration.

Multi-account AWS auditing does not model Tier 2 or Tier 3 cross-account relationships. It focuses on sequential credential switching and identity validation to run independent single-account audit workflows, consolidating findings without mapping resource connections across accounts.

Sequential AWS security audits enforce account-scoped guardrails by validating accounts.yaml, checking account ID formats and strategy requirements, isolating credentials between accounts, and verifying identity before running the audit workflow for each enabled account.