aws-terraform-security-reviewer

What This Skill Does

The aws-terraform-security-reviewer is a specialized security analysis tool designed for DevOps and Cloud Engineers. It acts as an automated security architect, scanning your Terraform HCL files and JSON-formatted terraform plan outputs to identify potential AWS misconfigurations before they are deployed to your infrastructure. By leveraging this skill, teams can shift security left, reducing the risk of data leaks, unauthorized access, and compliance violations associated with infrastructure-as-code (IaC).

Installation

You can install this skill directly via the OpenClaw command-line interface. Run the following command in your terminal: clawhub install openclaw/skills/skills/anmolnagpal/terraform-reviewer

Use Cases

This skill is ideal for:

1. Pre-deployment Security Gates: Integrate into your CI/CD pipeline to block or flag risky Terraform changes before they reach production.
2. Compliance Audits: Map your infrastructure configuration directly against CIS AWS Foundations Benchmark v2.0 controls.
3. Peer Review Assistance: Generate structured, GitHub-ready review comments for your team members to streamline code reviews and enforce best practices.

Example Prompts

1. "Here is my tfplan.json file. Please analyze it for any S3 buckets that are publicly accessible or missing server-side encryption."
2. "I am defining a new EKS cluster. Can you check my HCL code for any insecure API endpoint settings and verify if my security group rules are too broad?"
3. "Review this resource block for an EC2 instance. Ensure that IMDSv2 is enforced and that it isn't assigned a public IP address."

Tips & Limitations

• Provide Context: The more data you provide (HCL files combined with terraform plan output), the more accurate the analysis.
• No Real-Time Access: Remember that this tool is instruction-only. It cannot access your AWS account directly; it depends entirely on the data you provide.
• Data Privacy: Ensure you sanitize any sensitive information such as secret keys or proprietary ARNs before pasting. While the AI is robust, treat your plan outputs as sensitive configuration data.
• Limitations: A terraform plan only shows the intended state. It cannot detect drift or existing misconfigurations that were applied manually outside of your Terraform state.