Generate an automated AWS security audit script checking IAM, S3, EC2, RDS, and CloudTrail configurations against CIS benchmarks.
You are an AWS security specialist. Create an automated security audit script. ## Configuration - **AWS Accounts**: [ACCOUNTS e.g. single account / multi-account with AWS Organizations] - **Regions**: [REGIONS e.g. all enabled / specific regions] - **Benchmark**: [BENCHMARK e.g. CIS AWS Foundations v3.0 / AWS Well-Architected Security] - **Language**: [LANG e.g. Python boto3 / Bash AWS CLI / Go AWS SDK] - **Output**: [OUTPUT e.g. JSON / HTML report / CSV / JIRA tickets] ## Audit Checks ### IAM Security (25 checks) - Root account MFA enabled - Root account access keys disabled - Password policy meets requirements (14+ chars, complexity, rotation) - No IAM users with console access without MFA - No access keys older than 90 days - No unused credentials (90 days) - No inline policies on users (use groups/roles) - No wildcard (*) in IAM policies - No IAM policies with full admin access attached to users - Cross-account role trust policy review - Service-linked roles audit - IAM Access Analyzer findings check ### S3 Security (15 checks) - No public buckets (Block Public Access enabled) - Default encryption enabled on all buckets - Bucket versioning enabled for critical buckets - Access logging enabled - No buckets with overly permissive policies - SSL-only access enforced - Object Lock for compliance data - Lifecycle policies configured ### EC2/VPC Security (20 checks) - No security groups with 0.0.0.0/0 ingress on management ports (22, 3389) - No public IPs on non-web instances - VPC Flow Logs enabled - EBS volumes encrypted - IMDSv2 enforced (no v1) - Systems Manager patch compliance - No unattached EBS volumes - No default VPC in use - NACLs restrict inbound traffic ### RDS Security (10 checks) - Encryption at rest enabled - No public accessibility - Multi-AZ for production - Automated backups enabled with sufficient retention - Minor version auto-upgrade enabled - Enhanced monitoring enabled - IAM database authentication - SSL enforced for connections ### Logging & Monitoring (15 checks) - CloudTrail enabled in all regions - CloudTrail log file validation enabled - CloudTrail logs encrypted with KMS - CloudWatch alarms for root login, IAM changes, security group changes - GuardDuty enabled in all regions - Config recorder enabled - VPC flow logs to CloudWatch ## Reporting - Finding severity: CRITICAL, HIGH, MEDIUM, LOW, PASS - CIS benchmark control mapping - Remediation steps with AWS CLI commands - Summary statistics and compliance score - Trend analysis against previous audits - Export to [OUTPUT] Generate the complete audit script with parallel execution for performance.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.0 Flash, Llama 4 Maverick.
Configure AWS credentials with read-only access. Run the audit script against non-production first. Review findings and create remediation tickets. Schedule regular audits (monthly recommended).
Initial release
Sign in and download this prompt to leave a review.