Validate AWS Compliance Against Standards

This skill runs automated compliance validation against four industry standards - CIS AWS Foundations Benchmark, PCI-DSS, HIPAA, and SOC 2 - covering identity and access management, logging and monitoring, networking, and data protection controls. For CIS specifically it provides ready-to-run bash scripts for four control families: Identity & Access Management (1.x), Logging (2.x), Monitoring (3.x), and Networking (4.x). Separate Python and bash scripts handle PCI-DSS and HIPAA checks, and a compliance-report.py script assembles a JSON report with a pass/fail score across whichever framework is selected.

Use this skill to validate AWS compliance against CIS, PCI-DSS, HIPAA, or SOC 2, to prepare for an audit, or to run continuous compliance monitoring. It is not a substitute for environment-specific validation, testing, or expert review - run the generated checks against your own account and treat findings as a starting point, not a final audit verdict. Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

The CIS IAM script (cis-iam-checks.sh) checks root account usage and MFA, flags credentials unused for more than 90 days, flags access keys older than 90 days, verifies the account password policy's minimum length/complexity/rotation settings, and flags IAM users without MFA. The CIS logging script (cis-logging-checks.sh) checks whether CloudTrail is enabled and multi-region, whether log file validation is on, whether the CloudTrail S3 bucket is publicly accessible, whether CloudTrail is integrated with CloudWatch Logs, whether AWS Config is enabled, whether S3 buckets have access logging, and whether VPCs have Flow Logs enabled. The CIS monitoring script (cis-monitoring-checks.sh) checks for 14 required CloudWatch metric filters (unauthorized API calls, no-MFA console sign-in, root usage, IAM/CloudTrail/CMK/S3-policy/Config/security-group/NACL/gateway/route-table/VPC changes, and console sign-in failures). The CIS networking script (cis-networking-checks.sh) flags security groups open to 0.0.0.0/0 on SSH (22) or RDP (3389), and checks that default security groups restrict all traffic. pci-dss-checker.py (boto3) flags internet-open security groups, unencrypted EBS volumes, IAM users without MFA, and a missing CloudTrail trail. hipaa-checker.sh checks MFA, CloudTrail presence, EBS/RDS encryption at rest, and reminds to verify TLS 1.2+ in transit. compliance-report.py runs the checks for a chosen framework (cis/pci/hipaa) and outputs a JSON report with total/passed/failed counts and a percentage score, saved to a dated compliance-<framework>-<date>.json file.

Invocable via example prompts such as "Run CIS AWS Foundations compliance check", "Generate a PCI-DSS compliance report", "Check HIPAA compliance for my AWS account", "Audit against SOC 2 requirements", and "Create a compliance dashboard." It also integrates with the Kiro CLI:

kiro-cli chat "Use aws-compliance-checker to run CIS benchmark"

Best practices named in the source: run compliance checks weekly, automate with Lambda/EventBridge, track compliance trends over time, document exceptions with justification, integrate with AWS Security Hub, and use AWS Config Rules for continuous monitoring.

Cloud security and compliance engineers who need to validate an AWS account against CIS, PCI-DSS, HIPAA, or SOC 2 controls, prepare audit evidence, or run recurring automated compliance checks rather than manually walking each control.