skills.rest
IgorSasovets
IgorSasovetsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

iac-threat-model

Builds STRIDE-based threat models for AWS Terraform and CloudFormation infrastructure.

9|2|Updated Jul 15, 2026
Search Tags:#aws#threat modeling#STRIDE#cloudformation#DevSecOps#Terraform#iac security
One-click install
npx skills add https://github.com/IgorSasovets/devsecops-with-claude --skill iac-threat-model-igorsasovets
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: iac-threat-model
Source: https://github.com/IgorSasovets/devsecops-with-claude/tree/main/iac-security-review/.claude/skills/IAC_THREAT_MODEL
Command: npx skills add https://github.com/IgorSasovets/devsecops-with-claude --skill iac-threat-model-igorsasovets

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security teams reviewing Infrastructure as Code often lack a structured threat model, making audits generic and disconnected from the actual architecture. This Skill produces a STRIDE-based THREAT_MODEL.md for AWS IaC projects, either by interviewing a project stakeholder or by autonomously analyzing templates against built-in threat catalogs. ## Core Features & Use Cases - Adaptive interview mode: Runs a four-question framework (system context, threats, controls, validation) seeded by Grep scans of the project's Terraform and CloudFormation templates. - Autonomous mode: Generates a threat model from templates alone by matching resources against AWS, Terraform, CloudFormation, and OWASP IaC threat catalogs, with STRIDE gap-filling for uncovered categories. - Scanner report ingestion: Transforms Checkov, tfsec, and Prowler reports (JSON, SARIF, CSV, Markdown) into a normalized KNOWN_ISSUES.md with severity summaries and deduplication. - Use Case: Before auditing a Terraform repository, run this Skill to produce THREAT_MODEL.md with a scored threat table (likelihood × impact), which the downstream /iac-audit stage then uses for a targeted, threat-model-based assessment instead of a generic CIS check. ## Quick Start Ask the AI to threat model the infrastructure in your project directory, optionally passing --autonomous when no stakeholder is available or --known-issues with an existing scanner report.

Frequently Asked Questions about iac-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model for Terraform infrastructure?▼

Run the threat modeling workflow against your project root; it scans Terraform templates for resource types and hot spots, then either interviews you with four adaptive questions or autonomously matches resources against built-in threat catalogs to produce a STRIDE threat table.

What threat modeling method works for AWS CloudFormation security review?▼

STRIDE-based threat modeling works well for CloudFormation review. The Skill maps template resources to a CloudFormation-specific threat catalog covering parameters, IAM, stack policies, networking, encryption, and logging anti-patterns.

Can I import Checkov or tfsec scan results into a threat model?▼

Yes, existing scanner reports are ingested via the --known-issues flag. Checkov JSON, tfsec JSON/SARIF, Prowler JSON/CSV, and plain Markdown findings are auto-detected, normalized, deduplicated, and written to KNOWN_ISSUES.md.

Does threat modeling require someone who knows the project?▼

No. When no stakeholder is available, the --autonomous flag generates the threat model purely from template analysis and threat catalogs, marking inferred threats with [INFERRED] so auditors can distinguish them from confirmed context.

What are the limitations of static IaC threat modeling?▼

Static analysis only reads templates and config files; it never executes, deploys, or probes live infrastructure. It cannot detect runtime-only risks, and resource details are never fabricated—only Grep/Read-confirmed resources are referenced.

Related Skills

Explore More Software Engineering Skills→
Agentic-AI-Risk-MitigationAgentic-AI-Risk-Mitigation

Threat Model Generation Skill

Generates AWS threat models from IaC code with STRED, OWASP, MITRE ATT&CK classifications.

Official
Intermediate
KartikSharma4448KartikSharma4448

threat_modeling

Identify assets, trust boundaries, and threat vectors using STRIDE-inspired analysis.

Community
Intermediate
naporin0624naporin0624
3

iac-scanner

Detect security misconfigurations in Infrastructure as Code using tfsec and Checkov.

Community
Advanced
AI-Foundry-CoreAI-Foundry-Core
4

threat-mitigation-mapping

Map identified threats to security controls and generate prioritized remediation roadmaps.

Official
Advanced