Audit AWS Security Posture

Performs comprehensive security assessments of AWS environments to identify vulnerabilities and misconfigurations, across four audit categories: Identity & Access Management (overly permissive IAM policies, unused users/roles, MFA gaps, root account usage, access key rotation), Network Security (open security groups, public S3 buckets, unencrypted data in transit, disabled VPC flow logs, network ACL misconfigurations), Data Protection (unencrypted EBS/RDS, disabled S3 bucket encryption, missing backup policies, disabled KMS key rotation), and Logging & Monitoring (disabled CloudTrail, missing CloudWatch alarms, disabled VPC Flow Logs, S3 access logging, or Config recording).

Use this when you need to audit an AWS account's security posture, identify vulnerabilities, or prepare for a compliance assessment against the CIS AWS Foundations Benchmark, PCI-DSS, or HIPAA.

Not needed for a single, already-known misconfiguration you just want fixed, or for non-AWS environments.

Runs concrete AWS CLI checks per category and reports findings: users without MFA from a credential report, unused IAM users, AdministratorAccess-scoped policies, access keys older than 90 days, and root-account access keys; security groups open to 0.0.0.0/0, public S3 buckets, VPCs missing flow logs, and unencrypted RDS instances; unencrypted EBS volumes, S3 buckets without encryption, public RDS snapshots, and KMS keys with rotation disabled; and CloudTrail/AWS Config status plus S3 buckets missing access logging. A bundled bash script runs the full set of checks and prints a consolidated report, and a Python function calculates an overall security score.

aws iam get-credential-report --output text | \
  awk -F, '$4=="false" && $1!="<root_account>" {print $1}'

Findings map to compliance frameworks: CIS AWS Foundations Benchmark (root account usage, IAM/MFA controls, logging, monitoring), PCI-DSS (network security controls, secure configuration, access controls/MFA, logging), and HIPAA (access controls, audit controls, encryption, transmission security). Remediation is prioritized: Critical, fix immediately (root account access keys, public RDS snapshots, security groups open to the world on sensitive ports, disabled CloudTrail); High, within 7 days (users without MFA, unencrypted data at rest, missing VPC Flow Logs, overly permissive IAM policies); and Medium, within 30 days (old access keys, missing S3 access logging, unused IAM users, disabled KMS key rotation). Also supports Kiro CLI invocation, e.g. kiro-cli chat "Use aws-security-audit to assess my security posture".

Cloud security engineers and DevOps teams running recurring AWS security audits, preparing compliance evidence, or triaging findings by remediation priority - ideally on a weekly cadence, automated via Lambda/EventBridge, with results exported to S3 for trending and integrated with SIEM tools.