Review a cloud environment's security posture (AWS/Azure/GCP) across IAM, network, data protection, logging/monitoring, and workload configuration, mapped to CIS benchmarks, and produce ranked findings. Use for a CSPM-style assessment of an account/subscription/project you're authorized to review.
Pro scans all 2 files and shows the line behind each finding
Scanned 9/19/2026
Skills Directorynpx -y skills add jassics/awesome-claude-security --skill cloud-posture-review --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Cloud Posture Review?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/jassics-cloud-posture-review)More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.
---
name: cloud-posture-review
description: >-
Review a cloud environment's security posture (AWS/Azure/GCP) across IAM,
network, data protection, logging/monitoring, and workload configuration, mapped
to CIS benchmarks, and produce ranked findings. Use for a CSPM-style assessment of
an account/subscription/project you're authorized to review.
---
# Goal
A posture assessment across the major control domains, each with findings,
severity, and remediation, anchored to CIS Benchmarks / provider best practice.
# Control domains (see `reference.md` for per-provider checks)
1. **Identity & access** — IAM users/roles/policies, least privilege, MFA, root/
admin usage, key rotation, federation. (Deep dive: `cloud-iam-review`.)
2. **Network** — security groups/NSGs/firewall rules, public exposure, private
connectivity, segmentation, egress controls.
3. **Data protection** — storage exposure, encryption at rest/in transit, key
management, backups, public snapshots/buckets.
4. **Logging & monitoring** — audit logging (CloudTrail/Activity Log/Cloud Audit
Logs), log integrity, alerting, guard/threat services enabled.
5. **Workload & service config** — compute hardening, managed-service settings,
serverless permissions, secrets handling, metadata service (IMDSv2 etc.).
6. **Governance** — account/org structure, baseline guardrails (SCPs/Policies),
tagging, drift.
# Steps
1. Establish scope (accounts/subscriptions/projects, regions) and read access.
2. Walk each domain with `reference.md`; for identity use `cloud-iam-review`, for
exposure quick-wins use `cloud-misconfig-scan`.
3. Record per finding: domain · control (CIS ref) · observation · severity ·
remediation. Use provider config/posture data, not assumptions.
4. Score (`security-reporting:cvss`) and rank; highlight internet-exposed and
identity findings first.
# Output
A posture report grouped by domain with a CIS-mapped findings table + ranked top
risks. Confirmed issues → `security-reporting:finding`; architecture via
`security-diagramming:architecture-diagram`.
# Notes
Most cloud breaches trace to **identity** over-permission and **public exposure** of
data/compute — weight those. Map findings to CIS controls for traceability; verify
against the current benchmark version for the provider.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
