Review Infrastructure-as-Code (Terraform, CloudFormation, ARM/Bicep, Pulumi, Ansible, Helm) for security misconfigurations before deployment — public exposure, weak IAM, missing encryption, open networking, and hardcoded secrets. Use to shift-left and catch cloud/k8s misconfig at the code layer.
Pro scans all 2 files and shows the line behind each finding
Scanned 9/19/2026
Skills Directorynpx -y skills add jassics/awesome-claude-security --skill iac-security-review --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Iac Security Review?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/jassics-iac-security-review)More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.
---
name: iac-security-review
description: >-
Review Infrastructure-as-Code (Terraform, CloudFormation, ARM/Bicep, Pulumi,
Ansible, Helm) for security misconfigurations before deployment — public exposure,
weak IAM, missing encryption, open networking, and hardcoded secrets. Use to
shift-left and catch cloud/k8s misconfig at the code layer.
---
# Goal
A triaged set of IaC security findings, each tied to the resource/line and a fix —
so misconfigurations are caught before they reach a live environment.
# What to review (see `reference.md` for the checklist)
1. **Public exposure** — resources open to the internet (security groups/NSGs/
firewall `0.0.0.0/0`, public buckets/storage, public IPs on sensitive hosts).
2. **Identity** — over-broad IAM policies, wildcard permissions, default/no roles,
long-lived credentials defined in code, session duration raised beyond what the
workload needs, and trust policies missing confused-deputy conditions
(`aws:SourceArn`/`SourceAccount`/`ExternalId`) on third-party/cross-account roles.
3. **Encryption** — storage/volumes/databases without encryption at rest; TLS not
enforced; default/unmanaged keys.
4. **Logging & monitoring** — audit logging/flow logs not enabled by the IaC.
5. **Secrets** — hardcoded passwords/keys/tokens in variables, defaults, or state
(cross-ref `secrets-management-review`).
6. **Module/provider hygiene** — untrusted/unpinned modules, provider versions,
drift between code and deployed state.
7. **Helm chart defaults** — a chart's `values.yaml` default (empty `resources`,
`networkPolicy.enabled: false`, `ingress.tls: []`) silently becomes every
`helm install`'s config, not just this deployment's — a distribution-scale
version of the same "no safe default" risk, one layer up.
# Steps
1. Identify the IaC type and scope; run an IaC scanner if available (Checkov,
tfsec/Trivy, KICS, cfn-nag) or review the templates directly.
2. Triage findings: map each to the resource and confirm it's a real exposure (not
a scanner false positive); note severity and blast radius.
3. Check for hardcoded secrets and sensitive values in variables/state.
4. Provide the corrected IaC snippet per finding.
# Output
A findings table: file:line · resource · misconfig · severity · fix (corrected
snippet). Confirmed issues → `security-reporting:finding`. These map to the same
controls `cloud-security` / `k8s-security` check at runtime.
# Notes
Shift-left: fixing in IaC prevents the misconfig everywhere it's deployed and stops
drift. Treat secrets in code/state as high severity. Pin and vet third-party modules
— they run with your deploy credentials.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
