What problem does it solve? Manually reviewing Infrastructure as Code templates for security misconfigurations is slow and inconsistent, and teams often lack a repeatable way to check Terraform and CloudFormation files against both CIS AWS Foundations Benchmark controls and their own threat models. ## Core Features & Use Cases - Dual-path security audit: Runs a threat-model-based analysis driven by THREAT_MODEL.md and/or a CIS AWS Foundations Benchmark v4.0.1 control check, with flags to restrict to either path. - Parallel sub-agent fan-out: Spawns one sub-agent per template file (capped at 10 concurrent) for fast analysis of large projects, with a sequential mode for small ones. - CVSSv3.1-scored findings: Applies environmental score adjustments based on tier, internet exposure, and data classification, then deduplicates and writes CIS_BASED_FINDINGS.md, THREAT_MODEL_BASED_FINDINGS.md, and OVERALL_FINDINGS.md. - Use Case: After mapping a Terraform project and generating a threat model, run the audit to produce a severity-ranked findings report with exact line-level evidence and remediation guidance for every violated control. ## Quick Start Run the iac-audit skill on my project directory to audit all Terraform and CloudFormation templates for CIS benchmark violations and threat-model risks.
