Cloud Security & Container Hardening

Cloud Security & Container Hardening

Purpose

Enable Claude to assist with cloud security assessments across AWS, Azure, and GCP, container and Kubernetes security hardening, Infrastructure as Code (Terraform, CloudFormation, Kubernetes manifests) scanning, and cloud compliance reporting against CIS Benchmarks and major frameworks.

---

Activation Triggers

This skill activates when the user asks about:

• Auditing AWS IAM, S3, security groups, or cloud services
• Reviewing Azure RBAC, storage, NSGs, or Key Vault configuration
• Assessing GCP IAM, Cloud Storage, or GKE security
• Scanning Terraform files, CloudFormation templates, or Kubernetes manifests
• Hardening Docker containers or reviewing Dockerfiles
• Kubernetes RBAC, pod security, or network policies
• Cloud compliance (CIS, SOC2, PCI-DSS, HIPAA)
• Container image vulnerability scanning
• Cloud architecture security review
• IaC security scanning (tfsec, Checkov, Terrascan)

---

Prerequisites

pip install pyyaml boto3 requests

Recommended cloud security tools:

• AWS CLI — AWS auditing and management
• ScoutSuite — Multi-cloud security audit
• Prowler — AWS/Azure/GCP security assessment
• Checkov — IaC static analysis
• tfsec — Terraform security scanner
• Trivy — Container and IaC vulnerability scanner
• kube-bench — CIS Kubernetes Benchmark
• Falco — Container runtime security

---

Core Capabilities

1. AWS Security Auditing

When the user asks to audit AWS security:

Quick AWS security checks using CLI:

# IAM: Find users without MFA
aws iam get-account-summary
aws iam list-users | jq '.Users[].UserName' | xargs -I{} aws iam list-mfa-devices --user-name {}

# Find overly permissive policies
aws iam list-policies --scope Local --only-attached | jq '.Policies[].PolicyName'

# S3: Find public buckets
aws s3api list-buckets --query 'Buckets[].Name' | xargs -I{} aws s3api get-bucket-acl --bucket {}
aws s3api list-buckets --query 'Buckets[].Name' | xargs -I{} aws s3api get-bucket-policy-status --bucket {}

# Security groups: Find wide-open rules
aws ec2 describe-security-groups --filters "Name=ip-permission.cidr,Values=0.0.0.0/0" \
  --query 'SecurityGroups[*].{ID:GroupId,Name:GroupName,Rules:IpPermissions}'

# CloudTrail: Verify logging
aws cloudtrail describe-trails
aws cloudtrail get-trail-status --name [trail-name]

# Root account check
aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'