skills.rest
ivanshamaev
ivanshamaevCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

infra-network-security-review

Harden Kubernetes NetworkPolicies, audit cloud security groups, and validate private network design.

14|1|Updated May 5, 2026
Search Tags:#network security#vpc flow logs#privatelink#kubernetes networkpolicy#tls mTLS#aws security groups#private subnets
One-click install
npx skills add https://github.com/ivanshamaev/de-agent-skills --skill infra-network-security-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: infra-network-security-review
Source: https://github.com/ivanshamaev/de-agent-skills/tree/main/group_skills/infra_dataops_group_skills/infra_network_security_review
Command: npx skills add https://github.com/ivanshamaev/de-agent-skills --skill infra-network-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you identify and prevent insecure network configurations that expose data platforms to unauthorized access, lateral movement, and data exfiltration.

Core Features & Use Cases

  • Kubernetes NetworkPolicy hardening: Implements a default-deny model with explicit allow rules for namespace and pod-to-pod traffic (e.g., Airflow, Kafka, DB access).
  • Cloud security group and subnet review: Detects risky ingress patterns like 0.0.0.0/0, verifies that data services run in private subnets, and audits public exposure flags.
  • Encryption and traffic visibility: Enforces TLS/mTLS for service-to-service communication (Kafka, Postgres, Istio), designs private connectivity (VPC endpoints/PrivateLink vs peering), and analyzes VPC Flow Logs to spot suspicious traffic.

Quick Start

Ask the agent to produce a step-by-step network security review plan for your data platform using Kubernetes NetworkPolicy, AWS security group audit checks, TLS/mTLS enforcement targets, and VPC Flow Logs queries.

Frequently Asked Questions about infra-network-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a network security review for a data platform on AWS and Kubernetes?▼

A network security review for a data platform involves hardening Kubernetes NetworkPolicies with default-deny rules, auditing AWS security groups for risky ingress, and validating private subnets. It also requires enforcing TLS/mTLS and analyzing VPC Flow Logs to detect anomalies.

What is a default-deny Kubernetes NetworkPolicy and when do I need it?▼

A default-deny Kubernetes NetworkPolicy blocks all ingress and egress traffic by default, requiring explicit allow rules for pod-to-pod communication. You need it to prevent unauthorized lateral movement and isolate data platform services like Airflow, Kafka, and databases.

How do I detect lateral movement using VPC Flow Logs and security groups?▼

You detect lateral movement by analyzing VPC Flow Logs for suspicious traffic patterns and auditing AWS security groups for risky ingress rules like 0.0.0.0/0. Restricting data services to private subnets limits unauthorized access paths.

Does VPC peering or PrivateLink work better for private data platform connectivity?▼

VPC peering and PrivateLink both provide private connectivity, but PrivateLink offers more restricted exposure by keeping traffic on the AWS network. A network security review validates which design best prevents data exfiltration and unauthorized access for your specific topology.

How do I enforce TLS and mTLS across inter-service traffic?▼

Enforcing TLS and mTLS across inter-service traffic requires encrypting communications between Kafka, Postgres, and Istio services. A network security review identifies unencrypted paths and validates that mutual authentication is applied across the entire data platform.

Why does my data platform have public exposure despite running in private subnets?▼

Public exposure often occurs due to misconfigured AWS security groups with risky ingress patterns or unverified public exposure flags. A network security review audits these configurations to ensure data services remain isolated within properly hardened private subnets.

Related Skills

Explore More Software Engineering Skills→
haxlyshaxlys

k8s-security-policies

Generate and enforce Kubernetes NetworkPolicy, PodSecurityPolicy, and RBAC security policies.

Community
Advanced
gke-labsgke-labs
42

review-security-k8s-network

Analyze Kubernetes NetworkPolicies, Services, and Ingress for isolation gaps and exposure risks.

Official
Advanced
doanchienthangdevdoanchienthangdev
4

service-mesh

Configure Istio and Linkerd for traffic management, mTLS, and observability.

Community
Advanced
zebbernzebbern
4.5k

AWS Penetration Testing

Enumerate AWS IAM misconfigurations and privilege escalation paths.

Community
Advanced