security-hardening

CIS benchmarks provide security configuration guidelines for AWS and Kubernetes. This Skill applies those benchmarks by enabling CloudTrail, VPC Flow Logs, encrypting EBS volumes, configuring RBAC, enforcing pod security policies, and implementing network policies to reduce attack surface across multi-region deployments.

Pod security hardening includes running containers as non-root, enforcing read-only root filesystems, setting resource limits, dropping all capabilities, and disabling privilege escalation. These controls prevent privilege escalation attacks and limit blast radius if a container is compromised.

Infrastructure scanning integrates tools like Trivy for container images, tfsec for Yaml, Checkov for IaC, and Kubesec for Kubernetes manifests. Running these scanners via CLI commands validates that deployments comply with security policies and detects drift from hardened baselines.

Yes. Network policies restrict pod-to-pod and pod-to-external traffic, while secrets management examples show secure handling practices. Both are implemented through YAML manifests integrated into your deployment workflow to enforce least-privilege access.

Trivy scans container images and filesystems for vulnerabilities, tfsec audits Terraform code for misconfigurations, and Checkov validates IaC policies across multiple frameworks. Each targets a different layer—runtime, infrastructure code, and policy enforcement—for comprehensive hardening coverage.