aws-security-scanner

What This Skill Does

The aws-security-scanner skill provides an automated, scriptable interface for conducting security audits within your AWS environment. By leveraging the AWS CLI, it systematically inspects critical infrastructure components to identify misconfigurations that could lead to data exposure or unauthorized access. It focuses on the most common attack vectors, including publicly accessible S3 buckets, overly permissive IAM policies, stale credentials, insecure security group configurations (such as open SSH/RDP ports), and the status of audit trails via CloudTrail. This tool acts as a proactive defense mechanism, allowing developers and system administrators to quickly surface risks that might otherwise go unnoticed in complex cloud setups.

Installation

To integrate this skill into your environment, run the following command in your terminal: clawhub install openclaw/skills/skills/spclaudehome/aws-security-scanner

Ensure your terminal session has active AWS credentials configured via aws configure or an appropriate IAM execution role, as the tool inherits the permissions of the authenticated user to perform these read-only security checks.

Use Cases

This skill is ideal for:

• Regular Security Audits: Automate weekly compliance checks to ensure infrastructure adheres to CIS benchmarks.
• Incident Response: Quickly verify if an S3 bucket has been accidentally opened to the public during a breach investigation.
• IAM Hardening: Identify users lacking MFA or clean up dormant access keys that pose a security risk.
• Infrastructure Review: Quickly validate that production security groups are restricted to necessary IP ranges.
• Compliance Reporting: Generate snapshots of CloudTrail status and logging validation for audit documentation.

Example Prompts

1. "Run a full security audit on my AWS account and flag any public S3 buckets or open security groups."
2. "Check my IAM users for those without MFA enabled and identify any access keys older than 90 days."
3. "Is CloudTrail enabled and properly configured for log validation across all regions in my AWS account?"

Tips & Limitations

• Permissions: The tool requires sufficient ReadOnly access to your AWS resources. Ensure your execution role includes permissions like s3:GetBucketAcl, iam:ListUsers, and ec2:DescribeSecurityGroups.
• Cost: While most commands are read-only and generate minimal costs, frequent execution against very large environments may incur minor API usage fees.
• Scope: This skill provides a baseline audit. For enterprise-grade compliance, it should be used in conjunction with native AWS services like Security Hub or Amazon Inspector.
• Environment: This skill relies on the AWS CLI being pre-installed and authorized in the environment where the OpenClaw agent is running.