Secure Cloud Network Access Rules

This is a multi-cloud security-group skill covering AWS Security Groups, Azure Network Security Groups, and GCP firewall rules, built around least-privilege access (specific ports over ranges, CIDR blocks over 0.0.0.0/0, security-group references over IP ranges) and defense-in-depth (layering NACLs and subnet controls with security groups, filtering both ingress and egress, separating rules by application tier). It gives platform-specific patterns: Terraform HCL for AWS tiered security groups (a web tier allowing HTTPS/HTTP only from a named ALB security group, a database tier allowing PostgreSQL only from the app tier plus a specific admin subnet, with no outbound internet access), Azure JSON rules with explicit priorities (a low-priority DenyAllInbound catch-all at 4096, overridden by a higher-priority AllowHTTPSFromAzureLB rule at 100), and GCP gcloud commands using source and target tags rather than IP ranges to scope firewall rules to specific instance roles. It includes a working audit script to find overly permissive AWS rules:

import boto3

def audit_security_groups():
    ec2 = boto3.client('ec2')
    response = ec2.describe_security_groups()
    
    risky_groups = []
    
    for sg in response['SecurityGroups']:
        for rule in sg['IpPermissions']:
            for ip_range in rule.get('IpRanges', []):
                if ip_range['CidrIp'] == '0.0.0.0/0':
                    risky_groups.append({
                        'GroupId': sg['GroupId'],
                        'GroupName': sg['GroupName'],
                        'Port': rule.get('FromPort', 'All'),
                        'Protocol': rule['IpProtocol']
                    })
    
    return risky_groups

Use this skill when writing or reviewing security-group and firewall rules on AWS, Azure, or GCP - it names concrete anti-patterns to catch (an ingress rule opening ports 0-65535 to 0.0.0.0/0 is flagged explicitly as the "BAD" example, contrasted with a "GOOD" rule scoped to port 443 and a specific source security group) and gives an AWS Config rule (INCOMING_SSH_DISABLED) for automated compliance monitoring. It also covers dynamic, auto-scaling security groups and multi-environment rule templates, explicitly noting that a dev environment's more permissive 0.0.0.0/0 CIDR is a deliberate development-only tradeoff, not something to carry into staging or prod. It is not a general cloud-IAM or application-security skill - it's scoped specifically to network-layer security group and firewall rule configuration, so it isn't the right tool for identity/access-policy or application-code security review.

Input is the application's tier structure (web, app, database) and required network paths between them; output is platform-specific security-group or firewall-rule definitions - Terraform aws_security_group resources, Azure securityRules JSON with explicit priorities, and GCP gcloud compute firewall-rules create commands - plus an automated audit script that flags any rule allowing 0.0.0.0/0 and an AWS Config rule for continuous SSH-exposure monitoring.

Built on Terraform (HCL) for AWS, ARM/JSON-style rule definitions for Azure, the gcloud CLI for GCP, boto3 for AWS API-based auditing, and AWS Config for ongoing compliance rule enforcement.

Cloud infrastructure and security engineers configuring network-layer access control across AWS, Azure, or GCP, who want platform-specific least-privilege patterns, named anti-patterns to avoid, and an audit script to catch overly permissive rules rather than reasoning about firewall rules from scratch per cloud.