Skill UI

This comprehensive skill provides a security posture assessment for AWS environments. It uses AWS CLI commands to audit critical security areas, including IAM policy review, network security groups, data encryption status (EBS, S3, RDS), and logging mechanisms (CloudTrail, VPC Flow Logs). Use this to proactively identify misconfigurations and ensure adherence to security best practices and compliance standards.

A comprehensive guide and set of scripts to systematically audit AWS S3 buckets for security misconfigurations. This tool identifies publicly exposed data, overly permissive ACLs, inadequate bucket policies, and missing encryption settings, ensuring adherence to least-privilege principles and compliance frameworks like SOC 2 or HIPAA.

A comprehensive guide and workflow for detecting unauthorized data exfiltration from AWS S3 buckets. It details how to leverage multiple AWS services—including CloudTrail, GuardDuty, Amazon Macie, and Athena—to analyze access patterns, identify bulk downloads, and detect cross-account data transfers, ensuring robust cloud compliance and security monitoring.

This skill details implementing a ransomware-resistant, immutable backup strategy using the restic tool. It leverages S3-compatible Object Lock (Compliance Mode) to ensure Write Once Read Many (WORM) storage, preventing deletion or modification by attackers. The process includes automated backup, cryptographic integrity verification (restic check), and scheduled restore testing, adhering to advanced security standards like 3-2-1-1-0.

Utilizes ScoutSuite, an open-source multi-cloud auditing tool, to perform comprehensive, agentless security posture assessments across AWS accounts. It queries various AWS APIs to enumerate all resources, identify misconfigurations (such as publicly exposed S3 buckets or weak IAM policies), and generate detailed, actionable HTML reports for compliance and security auditing.

This skill provides comprehensive procedures for identifying and remediating Amazon S3 bucket misconfigurations. It covers enabling Block Public Access settings, auditing policies and ACLs, enforcing default encryption (KMS/AES), and utilizing AWS Config/Lambda for automated remediation. It is essential for maintaining data compliance and responding to security incidents.

This skill focuses on detecting and mitigating sophisticated code injection and privilege escalation attacks across the entire serverless ecosystem (AWS Lambda, Azure, GCP). It combines static analysis of dangerous code sinks (e.g., eval, exec) with continuous monitoring of event sources (S3, SQS, API Gateway) and rigorous IAM auditing. It provides a comprehensive framework to secure the expanding serverless attack surface.