Security Review
- 3 installs
- 12 repo stars
- Updated June 8, 2026
- aws-samples/sample-claude-code-plugins-for-startups
security-review is a Claude Code skill that audits AWS infrastructure code and configurations for security misconfigurations and hardens AWS environments.
About
This skill has Claude review AWS infrastructure code and configurations for security issues. It scans IaC (CDK, Terraform, CloudFormation, SAM), runs checks against an IAM, networking, data, and logging checklist, and classifies findings by severity with remediation. A developer uses it when auditing IAM policies or hardening an AWS environment.
- Security checklist across IAM, networking, data, and logging/monitoring
- Runs checkov, cfn-nag, and tfsec against IaC and classifies findings by severity
- Gotchas like iam:PassRole privilege escalation and KMS-vs-IAM policy separation
Security Review by the numbers
- 3 all-time installs (skills.sh)
- Ranked #1,759 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Jul 28, 2026 (Skillselion catalog sync)
security-review capabilities & compatibility
- Capabilities
- security audit · code review
- Works with
- aws · terraform
- Use cases
- security audit · code review
What security-review says it does
Review AWS infrastructure code and configurations for security issues. Use when auditing IAM policies, reviewing IaC templates for security misconfigurations, checking for exposed resources, or harden
npx skills add https://github.com/aws-samples/sample-claude-code-plugins-for-startups --skill security-reviewAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 3 |
|---|---|
| repo stars | ★ 12 |
| Last updated | June 8, 2026 |
| Repository | aws-samples/sample-claude-code-plugins-for-startups ↗ |
What it does
Audit AWS IaC and configurations for security misconfigurations across IAM, networking, data, and logging, with severity-ranked fixes.
Who is it for?
Teams auditing AWS IaC and IAM policies for security risks before shipping or hardening an environment.
When should I use this skill?
The user asks to audit IAM policies, review IaC for security misconfigurations, check for exposed resources, or harden an AWS environment.
What you get
A severity-classified list of AWS security findings with specific remediation across IAM, networking, data, and logging.
- severity-classified findings table with remediation
By the numbers
- 4-domain security checklist (IAM, networking, data, logging)
- findings classified Critical/High/Medium/Low
Files
You are an AWS security reviewer. Audit infrastructure code and configurations for security risks.
Review Process
1. Scan the codebase for IaC files (CDK, Terraform, CloudFormation, SAM) 2. Use the aws-iac MCP tools to run security checks on templates 3. Check for the issues in the checklist below 4. Classify findings by severity: Critical, High, Medium, Low 5. Provide specific remediation for each finding
Security Checklist
IAM
- [ ] No
*in Action or Resource (unless scoped with conditions) - [ ] No inline policies on users — use roles and groups
- [ ] MFA enforced for console access
- [ ] Access keys rotated or eliminated (use IAM roles instead)
- [ ] Cross-account access uses external ID
Networking
- [ ] No security groups with 0.0.0.0/0 on non-HTTP(S) ports
- [ ] VPC Flow Logs enabled
- [ ] Private subnets for databases and internal services
- [ ] NACLs as defense-in-depth, not primary control
Data
- [ ] Encryption at rest enabled (S3, RDS, EBS, DynamoDB)
- [ ] Encryption in transit (TLS everywhere)
- [ ] S3 buckets: Block Public Access enabled, no public ACLs
- [ ] RDS: no public accessibility, encrypted snapshots
- [ ] Secrets in Secrets Manager or SSM Parameter Store, never in code
Logging & Monitoring
- [ ] CloudTrail enabled in all regions
- [ ] GuardDuty enabled
- [ ] Config rules for compliance
- [ ] Alarms on root account usage
Gotchas
s3:GetObjecton*in a bucket policy is not always wrong — but verify it's intentional- Lambda execution roles often get
logs:*— scope to the specific log group - CDK's default security group allows all outbound — this is usually fine but document it
- Terraform
aws_security_groupdefault allows all egress — same as CDK - KMS key policies are separate from IAM policies — both must allow access
iam:PassRoleis a privilege escalation vector — restrict which roles can be passed
Output Format
| Severity | Resource | Issue | Remediation |
|---|---|---|---|
| Critical | ... | ... | ... |
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
What does the AWS security-review skill check?
It runs a checklist across IAM (no wildcard actions, MFA, no inline user policies), networking (no open non-HTTP ports, VPC flow logs), data (encryption at rest and in transit), and logging (CloudTrail, GuardDuty).
Which tools does the skill run?
It is allowed to run checkov, cfn-nag, and tfsec against IaC templates and uses aws-iac MCP tools for security checks.