Validate AWS Compliance Against Standards

Automated compliance validation against industry standards: CIS AWS Foundations, PCI-DSS, HIPAA, and SOC 2. For CIS AWS Foundations it runs shell scripts checking Identity and Access Management (root account usage, root MFA, unused credentials over 90 days, access key rotation, password policy, IAM user MFA), Logging (CloudTrail enablement and multi-region/log-file-validation status, S3 bucket public access, CloudWatch Logs integration, AWS Config, S3 bucket access logging, VPC Flow Logs), Monitoring (a checklist of required CloudWatch metric filters such as unauthorized-api-calls, root-usage, and security-group-changes), and Networking (security groups open to 0.0.0.0/0 on SSH port 22 or RDP port 3389, and default security group rule hygiene).

For PCI-DSS it runs a Python/boto3 script checking network security groups open to the internet, unencrypted EBS volumes (Requirement 3.4), IAM users without MFA (Requirement 8.3), and CloudTrail presence (Requirement 10.1). For HIPAA it runs a shell script checking access controls (MFA per 164.312(a)(2)(i)), audit controls (CloudTrail per 164.312(b)), encryption at rest for EBS volumes and RDS instances (164.312(a)(2)(iv)), and flags a manual check for TLS 1.2+ in transit (164.312(e)(1)). It also includes an automated compliance-reporting script that runs the checks for a chosen framework, computes a pass/fail score, and writes a timestamped JSON report file.

kiro-cli chat "Use aws-compliance-checker to run CIS benchmark"

Use it to validate AWS compliance against CIS, PCI-DSS, HIPAA, or SOC 2, to prepare for an audit, or to run continuous compliance monitoring. It is not a substitute for environment-specific validation, testing, or expert review, and it should stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing - the PCI/HIPAA/CIS checks are scoped to the specific controls listed above, not a complete certification.

Inputs are AWS credentials/CLI access with permission to read IAM, CloudTrail, Config, EC2, S3, RDS, and security-group data. Output is per-check pass/warn/fail text (CIS bash scripts), a Python list of PCI-DSS issue strings, HIPAA warning lines tagged with the specific HIPAA citation, or a generated JSON compliance report with a computed pass/fail score, written to a timestamped local file.

Uses the AWS CLI (aws iam, aws cloudtrail, aws configservice, aws ec2, aws s3api, aws rds) plus jq and awk for the CIS shell checks, and the boto3 SDK for the PCI-DSS Python checker. It can be driven through Kiro CLI. The stated best practices recommend running checks weekly, automating with Lambda/EventBridge, tracking compliance trends over time, documenting exceptions with justification, integrating with AWS Security Hub, and using AWS Config Rules for continuous monitoring.

Cloud security and compliance engineers who need to validate an AWS account against CIS, PCI-DSS, HIPAA, or SOC 2 controls, generate audit-ready reports, or wire continuous compliance monitoring into their AWS account.