Cloud security posture reviewer · free AI skill

Reviews a described cloud environment against a structured security control framework spanning IAM, encryption at rest and in transit, network segmentation, vulnerability management, logging and monitoring, and…

Purpose

Assess a described cloud environment against a six-domain security control framework and produce scored findings, a ranked remediation plan, and a compliance gap map — so security leaders can move from "we think we're secure" to a defensible, prioritized posture assessment without a full manual audit.

When to Use

Invoke this skill when the user asks to:

Review the security posture of an AWS, Azure, or GCP environment
Assess cloud security controls against a checklist or framework
Prepare a cloud environment for a SOC 2, ISO 27001, or FedRAMP audit
Diagnose security gaps in an existing or newly provisioned cloud account
Harden IAM, encryption, network segmentation, or logging configurations
Build a remediation roadmap for cloud security findings

Inputs Required

Before starting, collect:

Cloud provider(s): AWS, Azure, GCP, or multi-cloud
Environment scope: What's in scope — production, staging, specific accounts/subscriptions/projects, workload types
IAM setup: How identity, roles, MFA, and privileged access are currently configured
Data & encryption: What data is stored, where, and current encryption at rest / in transit posture
Network architecture: VPC/VNet structure, segmentation, public exposure, ingress/egress controls
Logging & monitoring: What's currently logged (CloudTrail, Azure Monitor, Cloud Audit Logs), retention, alerting
Target compliance framework(s): SOC 2, ISO 27001, FedRAMP, or none specified

If the target compliance framework is unspecified, default to SOC 2 Type II as the baseline and note the assumption. If a domain's configuration is not described, mark it "Undocumented — assessment gap" rather than assuming it is secure.

Instructions

Step 1: Scope Confirmation & Risk Context

Establish what is being reviewed and against what standard.

Confirm the provider, in-scope accounts, and environment tier (production vs. non-production changes severity weighting)
Identify the data sensitivity tier: public / internal / confidential / regulated (PII, PHI, cardholder, federal)
Set the compliance lens (SOC 2 / ISO 27001 / FedRAMP) — this determines which controls are mandatory vs. recommended
Note any control described as "Undocumented" and flag it as an assessment gap to close

Step 2: Score Each of the Six Control Domains

For each domain, assign a maturity rating and cite specific findings. Use this scale:

Strong — control fully implemented, enforced, and monitored
Adequate — implemented but with gaps in coverage, enforcement, or evidence
Weak — partially implemented or not enforced
Missing — control absent
Undocumented — not described; cannot be assessed

Domain 1 — Identity & Access Management (IAM)

Root/global-admin account: MFA enforced, no daily use, no active access keys
Least privilege: policies scoped to need; no wildcard *:* or Owner-level sprawl
MFA enforced for all human users; SSO/federation over standalone accounts
Service/workload identities use roles, not long-lived static keys
Privileged access: just-in-time or break-glass with logging; regular access reviews
Password/key rotation policy and stale credential cleanup

Domain 2 — Encryption at Rest & in Transit

At rest: default encryption enabled on object storage, block storage, databases, snapshots, backups
Key management: customer-managed keys (CMK/KMS) where required; key rotation enabled
In transit: TLS 1.2+ enforced; no plaintext internal service traffic; HTTPS-only endpoints
No publicly readable storage buckets/blobs holding sensitive data
Secrets stored in a secrets manager, not in code, env vars, or config

Domain 3 — Network Segmentation

Environments (prod/non-prod) isolated at the network boundary
Security groups / NSGs / firewall rules follow deny-by-default; no 0.0.0.0/0 on sensitive ports (22, 3389, database ports)
Public vs. private subnet separation; sensitive workloads not directly internet-facing
Egress filtering in place; no unrestricted outbound
WAF and DDoS protection on public entry points; private connectivity (PrivateLink/Private Endpoint) for internal services

Domain 4 — Vulnerability Management

Automated image/host scanning; base images patched and maintained
Defined patch SLAs by severity (e.g., critical within 15 days for FedRAMP)
Container/registry scanning and IaC scanning in CI/CD
Exposure of unpatched public-facing services; EOL runtimes or OS versions
Remediation tracking with ownership and deadlines

Domain 5 — Logging & Monitoring

Provider-native audit logging enabled across all accounts/regions (CloudTrail / Azure Activity + Diagnostic / Cloud Audit Logs)
Logs centralized, tamper-resistant, and retained to meet the target framework (SOC 2: 12 months; FedRAMP: often longer)
Security monitoring: GuardDuty / Defender for Cloud / Security Command Center enabled
Alerting on high-risk events (root login, IAM policy change, security group open, key deletion)
Incident response runbook and defined escalation path

Domain 6 — Compliance Alignment

Map current posture to the target framework's control families
SOC 2: access controls, change management, monitoring, encryption, availability
ISO 27001: Annex A controls — A.5 (access), A.8 (asset/crypto), A.12 (operations), A.16 (incident)
FedRAMP: NIST 800-53 baseline — AC, AU, SC, SI families; boundary and continuous monitoring
Identify controls with no supporting evidence — audit failures come from missing evidence as often as missing controls

Step 3: Assign Severity to Each Finding

Rate every gap on likelihood × impact:

Critical — active exploitable exposure (public sensitive data, open admin ports, unencrypted regulated data, no MFA on privileged access)
High — significant gap likely to cause a breach or audit failure
Medium — meaningful weakness with partial mitigation
Low — hardening opportunity or best-practice gap Weight production and regulated-data findings one level higher than equivalent non-prod findings.

Step 4: Build the Ranked Remediation Plan

Order remediation by severity, then by effort-to-impact ratio (quick wins first within a severity band). For each of the top 10 actions provide:

The finding and affected domain
Severity
Specific remediation step (concrete, provider-appropriate — not "improve IAM")
Effort estimate: Quick (<1 day) / Moderate (days) / Project (weeks)
Compliance control(s) it satisfies

Step 5: Produce the Compliance Gap Map & Posture Summary

A table mapping each of the six domains → maturity rating → target-framework status (Met / Partial / Gap)
An overall posture score: sum domain ratings into a summary (e.g., "3 of 6 domains Adequate or better; 2 Critical findings block audit readiness")
A one-paragraph executive summary written for a CISO: current state, top risks, and audit-readiness verdict

Output Format

Structure: Scope summary → six-domain findings (rated, with specific observations) → severity-classified findings list → top 10 ranked remediation plan → compliance gap map table → executive posture summary
Length: 1,100–1,500 words
Format: Structured document — findings as labeled bullets per domain, remediation as a numbered ranked list, gap map as a table
Sections: Scope & Risk Context → Domain Findings (IAM, Encryption, Network, Vulnerability, Logging, Compliance) → Severity-Classified Findings → Top 10 Remediation Plan → Compliance Gap Map → Executive Summary
Tone: Security assessor — evidence-based, direct, and unsentimental; states risk plainly without alarmism and never marks an undocumented control as passing

Quality Checklist

Before delivering output, verify:

[ ] All six control domains are rated with a specific maturity level (Strong/Adequate/Weak/Missing/Undocumented)
[ ] Every finding cites a concrete observation, not a generic control statement
[ ] No undescribed control is assumed secure — undocumented items are flagged as assessment gaps
[ ] Top 10 remediation actions are ranked by severity and each names a specific, provider-appropriate fix
[ ] The compliance gap map maps all six domains to Met/Partial/Gap against the target framework
[ ] Every remediation action is tied to at least one compliance control it satisfies

Notes

Public storage exposure and missing MFA on privileged access are the two findings most likely to be Critical — check them first.
Audits fail on evidence as often as on controls; a technically-implemented control with no logging or documentation should be rated "Adequate" at best.
FedRAMP shifts many "recommended" controls to mandatory and lengthens retention and patch SLAs — reweight severity accordingly when it is the target framework.
This review assesses a described configuration; recommend pairing it with automated tooling (Security Hub, Defender for Cloud, SCC, or a CSPM platform) for live evidence before an audit.

How to use this skill

This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.

Installing in Claude Code:

~/.claude/skills/<folder-name>/SKILL.md — auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)
<your-project>/.claude/skills/<folder-name>/SKILL.md — auto-loads only when working in that project (recommended for project-specific skills)

Restart Claude Code or open a new session to register.

Using in Claude.ai, ChatGPT, Gemini, or other AI tools:

Drag this file into a new chat, or copy and paste its contents
Send your task or request as your next message — the AI will apply the skill where it fits

For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills