remediate-aws-terraform

To remediate AWS Terraform security findings safely, this Skill transforms checkov and tfsec results into a staged PR sequence ordered by blast radius, ensuring each fix is atomic and revertible.

Prioritizing AWS infrastructure remediations by blast radius is handled by ordering fixes from security findings into a staged sequence, applying the least destructive changes first and requiring dual-run for high-impact actions.

Yes, you can generate a staged PR sequence for AWS Config and PCI compliance issues by mapping the findings into atomic, reviewable pull requests with rollback readiness and validation plans.

Dual-run validation for destructive Terraform changes is enforced as a guardrail, ensuring that high blast-radius modifications are tested before deployment and that a rollback plan is available.

To track and rollback AWS infrastructure remediation PRs, the workflow provides inventory tracking, PR templates, and rollback procedures so each staged change remains revertible if validation fails.

When remediating AWS infrastructure with Terraform, the main constraint is that destructive changes require a dual-run process and must be sequenced by blast radius, which may slow down urgent fixes.