Cloud Security
Cloud Security is a skill for assessing cloud infrastructure (AWS, Azure, GCP) for security misconfigurations, including IAM privilege escalation paths, S3 public exposure, open security group rules, and infrastructure-as-code (IaC) security gaps. It provides a methodology and a Python tool (cloud_posture_check.py) to systematically analyze configurations and produce findings with severity levels and remediation guidance.
✨ What it does
- Detects IAM privilege escalation patterns (e.g., PassRole + CreateFunction) and overprivileged grants.
- Assesses S3 bucket configurations for public access, ACLs, and encryption.
- Analyzes security group rules for critical port exposure (SSH, RDP, all traffic) and database ports.
- Reviews infrastructure-as-code (Terraform, CloudFormation, Kubernetes) for security issues.
- Provides severity ratings and least-privilege remediation suggestions.
- Supports severity modifiers for internet-facing or regulated-data resources.
🎯 When to use it
- When you need to assess cloud infrastructure for security misconfigurations before deployment or as part of a security review.
- When you suspect IAM policies may contain privilege escalation paths or overprivileged grants.
- When you need to check S3 buckets for public exposure or missing encryption.
- When you need to review security group rules for open admin or database ports to the internet.
- When you want to integrate cloud security checks into CI/CD pipelines to prevent misconfigured resources from reaching production.
🚀 How to use
Trigger the skill by asking for a cloud security posture assessment or by running the provided Python script. Provide the necessary configuration files (IAM policy JSON, S3 bucket config, security group rules) or use cloud provider CLI commands to export them. The tool auto-detects check type or you can specify with --check. Example prompts:
Assess this IAM policy for privilege escalation paths: [paste policy JSON]
Run a cloud security check on my S3 bucket configuration.
📄 Output: The skill produces a JSON report with findings, severity levels, and remediation suggestions, along with exit codes indicating the urgency of remediation.
📦 Add this skill to Claude Code
# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills
# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering-team/skills/cloud-security .claude/skills/cloud-securitySkill source: engineering-team/skills/cloud-security/SKILL.md
⚠️ Good to know
Requires read access to IAM policy documents, S3 bucket configurations, and security group rules in JSON format; it is not for incident response or application vulnerability scanning.
❓ FAQ
What exit codes does the cloud_posture_check.py tool return?
Exit code 0 means no high/critical findings; exit code 1 means high-severity findings requiring remediation within 24 hours; exit code 2 means critical findings requiring immediate remediation.
How does the skill handle severity for internet-facing resources?
You can use the --severity-modifier internet-facing flag to bump each finding's severity by one level for resources directly accessible from the internet.
Does the skill cover Azure and GCP?
Yes, it provides partial coverage for Azure and GCP in IAM, storage, network, and IaC checks, as detailed in the provider coverage matrix.
🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.