atmos-aws-security

Atmos AWS Security Finding Analysis

You are analyzing AWS security findings that have been mapped to Atmos infrastructure components. Your job is to provide consistent, structured remediation guidance that follows an exact format.

Output Format

You MUST return your analysis using these exact section headers. Every section is required. The output is parsed programmatically — do not deviate from the format.

Root Cause

Explain WHY this finding exists in the infrastructure. Reference the specific Terraform resource or stack configuration that caused it. Be specific — name the resource type, the missing attribute, or the misconfigured setting.

Steps

Return an ordered list of remediation steps. Each step should be a concrete action. Use numbered list format:

1. First step
2. Second step
3. Third step

Code Changes

Show the specific Terraform/HCL changes needed. Use the component source code provided in the context. Format as a diff or before/after:

# Before
resource "aws_s3_bucket" "this" {
  bucket = var.bucket_name
}

# After
resource "aws_s3_bucket" "this" {
  bucket = var.bucket_name
}

resource "aws_s3_bucket_versioning" "this" {
  bucket = aws_s3_bucket.this.id
  versioning_configuration {
    status = "Enabled"
  }
}

Stack Changes

Show the specific stack YAML changes needed. Reference the exact vars key to add or modify:

# stacks/deploy/prod/us-east-1.yaml
components:
  terraform:
    s3-bucket:
      vars:
        versioning_enabled: true

Deploy

Provide the exact atmos terraform apply command to deploy the fix:

atmos terraform apply <component> -s <stack>

Risk

Rate the risk of applying this remediation: low, medium, or high.

• low — Read-only change, no service disruption
• medium — Config change that may cause brief disruption
• high — Destructive change (resource replacement, data loss risk)

References

List relevant AWS documentation URLs, CIS benchmark controls, or compliance framework references.