Service Mesh Security Analyzer
Comprehensive security analysis for Istio, Consul, and Linkerd service mesh configurations with NIST 800-53 Rev 5 control mappings.
Quick Start
Analyze a Configuration File
# Run the analyzer wrapper directly
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js <config-file>
# Examples
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-meshconfig.yaml
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./consul-config.json
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./linkerd-config.yaml --json
Sample Configurations
Test configs are available in the samples/ directory:
- Istio:
samples/sample-meshconfig.yaml
- Consul:
samples/sample-consul-config.json
- Linkerd:
samples/sample-linkerd-config.yaml
Supported Mesh Types
Istio
Auto-detection: Files with kind: MeshConfig and apiVersion containing istio.io
Security Checks:
| Category |
What It Checks |
| mTLS |
Enabled status, STRICT mode enforcement |
| Certificates |
CA provider, validity duration (optimal 90 days) |
| Peer Authentication |
Default peer auth, STRICT mode |
| Proxy Config |
Privileged mode, image versioning, holdApplicationUntilProxyStarts |
| Secret Discovery |
SDS enabled for certificate management |
| Trust Domain |
Explicitly configured, not using default |
| Authorization |
Default deny policies |
| Telemetry |
Enabled collection, access logging |
| RBAC |
Role-based access control enforcement |
| Traffic Policy |
Outbound traffic restricted to REGISTRY_ONLY |
Consul
Auto-detection: Files with mesh_type: "consul" or containing connect, tls, and acl fields
Security Checks:
| Category |
What It Checks |
| Service Mesh |
Connect enabled |
| Proxy Security |
No privileged mode |
| TLS Security |
verify_incoming, verify_outgoing, hostname verification |
| Access Control |
ACL enabled, default deny policy, agent tokens |
| Telemetry |
Service metrics enabled |
| Auto-Encryption |
TLS auto-encrypt feature |
| Gossip Encryption |
Key configured, proper length, verification |
| FedRAMP Compliance |
TLS 1.2+, FIPS ciphers, strong encryption |
Linkerd
Auto-detection: Files with mesh_type: "linkerd" or containing identity, proxy, and policy fields
Security Checks:
| Category |
What It Checks |
| TLS Security |
Enabled, enforced, cipher suites, min version 1.2 |
| Service Identity |
Enabled, certificate issuer, validity period |
| Proxy Config |
Non-privileged, versioning, timeouts, resource limits |
| Authorization |
Policy enforcement, default deny, specific rules |
| Authentication |
Strict mode enforcement |
| Observability |
Tracing enabled, sampling, collector config |
| Metrics |
Enabled, Prometheus integration, retention |
| Traffic Rules |
TLS in destination rules, system namespace protection |
Severity Levels
| Level |
Meaning |
Example Issues |
| Critical |
Immediate security risk |
RBAC/ACL disabled, mTLS not enforced, gossip encryption missing |
| High |
Significant vulnerability |
Permissive auth modes, privileged containers, missing hostname verification |
| Medium |
Security weakness |
Default trust domains, long certificate validity, missing telemetry |
| Low |
Best practice violation |
Non-pinned images, missing timeouts, default CA providers |
NIST 800-53 Control Mappings
Findings are mapped to these NIST 800-53 Rev 5 controls:
| Control |
Title |
Relevant Checks |
| AC-3 |
Access Enforcement |
RBAC, ACL, Authorization policies |
| AC-4 |
Information Flow Enforcement |
Outbound traffic policy, Policy enforcement |
| AC-17 |
Remote Access |
mTLS, TLS configuration |
| AU-2 |
Audit Events |
Telemetry, Access logging |
| AU-3 |
Content of Audit Records |
Logging configuration |
| AU-12 |
Audit Generation |
Metrics, Tracing |
| CA-3 |
System Interconnections |
Trust domain, Peer authentication |
| CM-2 |
Baseline Configuration |
Proxy config, Default settings |
| CM-6 |
Configuration Settings |
Security hardening |
| CM-7 |
Least Functionality |
Privileged mode, Outbound restrictions |
| IA-2 |
Identification and Authentication |
Service identity, Authentication |
| IA-5 |
Authenticator Management |
Certificate management, SDS |
| SC-7 |
Boundary Protection |
Traffic policy, Network segmentation |
| SC-8 |
Transmission Confidentiality |
mTLS, TLS settings |
| SC-12 |
Cryptographic Key Management |
Certificate validity, CA settings |
| SC-13 |
Cryptographic Protection |
Cipher suites, TLS versions |
| SC-23 |
Session Authenticity |
Peer authentication, Trust chain |
| SI-4 |
System Monitoring |
Telemetry, Metrics, Tracing |
Workflow: Analyze a Mesh Configuration
- Read the configuration file to understand its structure
- Run the analyzer using the wrapper script
- Review findings by severity (Critical first)
- Check NIST mappings for compliance requirements
- Generate remediation recommendations if needed
Example Analysis Session
User: Analyze my Istio mesh configuration at ./istio-config.yaml
Steps:
1. Read the file to understand the mesh configuration
2. Run: node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-config.yaml
3. Present findings grouped by severity
4. Highlight critical/high severity issues first
5. Include NIST control mappings for compliance context
6. Offer to generate fixes or compliance report
Output Format
Markdown (Default)
## Security Analysis Results
**Mesh Type:** Istio
**File:** ./istio-config.yaml
**Total Findings:** 5
| Severity | Count |
|----------|-------|
| Critical | 1 |
| High | 2 |
| Medium | 2 |
| Low | 0 |
### Critical Findings
#### 1. mTLS Configuration
**Issue:** mTLS is not set to STRICT mode
**Location:** `spec.mtls.mode`
**Recommendation:** Set mTLS mode to STRICT to enforce mutual TLS
**NIST Controls:** SC-8, SC-13
JSON (--json flag)
{
"success": true,
"meshType": "istio",
"findings": [...],
"summary": { "critical": 1, "high": 2, "medium": 2, "low": 0, "total": 5 }
}
Related Skills
- mesh-remediation - Generate and apply security fixes
- mesh-compliance-reporter - Generate FedRAMP/NIST compliance reports
Programmatic Usage
const { analyzeConfig, formatFindings } = require('~/.claude/skills/mesh-security/lib/analyzer-wrapper.js');
// Analyze a config file
const results = analyzeConfig('./istio-config.yaml');
console.log(formatFindings(results));
// Or specify mesh type explicitly
const consulResults = analyzeConfig('./config.json', 'consul');
1---2name: mesh-security3description: Analyze Istio, Consul, and Linkerd service mesh configurations for security vulnerabilities with NIST 800-53 control mappings. Use when users need to audit mesh security, identify misconfigurations, check mTLS settings, review ACL policies, or prepare for FedRAMP assessments. Triggers on keywords like "mesh config", "istio security", "consul ACL", "linkerd policy", "service mesh audit", or "NIST compliance".4license: MIT5---67# Service Mesh Security Analyzer89Comprehensive security analysis for Istio, Consul, and Linkerd service mesh configurations with NIST 800-53 Rev 5 control mappings.1011## Quick Start1213### Analyze a Configuration File1415```bash16# Run the analyzer wrapper directly17node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js <config-file>1819# Examples20node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-meshconfig.yaml21node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./consul-config.json22node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./linkerd-config.yaml --json23```2425### Sample Configurations2627Test configs are available in the `samples/` directory:28- Istio: `samples/sample-meshconfig.yaml`29- Consul: `samples/sample-consul-config.json`30- Linkerd: `samples/sample-linkerd-config.yaml`3132## Supported Mesh Types3334### Istio3536**Auto-detection:** Files with `kind: MeshConfig` and `apiVersion` containing `istio.io`3738**Security Checks:**39| Category | What It Checks |40|----------|----------------|41| mTLS | Enabled status, STRICT mode enforcement |42| Certificates | CA provider, validity duration (optimal 90 days) |43| Peer Authentication | Default peer auth, STRICT mode |44| Proxy Config | Privileged mode, image versioning, holdApplicationUntilProxyStarts |45| Secret Discovery | SDS enabled for certificate management |46| Trust Domain | Explicitly configured, not using default |47| Authorization | Default deny policies |48| Telemetry | Enabled collection, access logging |49| RBAC | Role-based access control enforcement |50| Traffic Policy | Outbound traffic restricted to REGISTRY_ONLY |5152### Consul5354**Auto-detection:** Files with `mesh_type: "consul"` or containing `connect`, `tls`, and `acl` fields5556**Security Checks:**57| Category | What It Checks |58|----------|----------------|59| Service Mesh | Connect enabled |60| Proxy Security | No privileged mode |61| TLS Security | verify_incoming, verify_outgoing, hostname verification |62| Access Control | ACL enabled, default deny policy, agent tokens |63| Telemetry | Service metrics enabled |64| Auto-Encryption | TLS auto-encrypt feature |65| Gossip Encryption | Key configured, proper length, verification |66| FedRAMP Compliance | TLS 1.2+, FIPS ciphers, strong encryption |6768### Linkerd6970**Auto-detection:** Files with `mesh_type: "linkerd"` or containing `identity`, `proxy`, and `policy` fields7172**Security Checks:**73| Category | What It Checks |74|----------|----------------|75| TLS Security | Enabled, enforced, cipher suites, min version 1.2 |76| Service Identity | Enabled, certificate issuer, validity period |77| Proxy Config | Non-privileged, versioning, timeouts, resource limits |78| Authorization | Policy enforcement, default deny, specific rules |79| Authentication | Strict mode enforcement |80| Observability | Tracing enabled, sampling, collector config |81| Metrics | Enabled, Prometheus integration, retention |82| Traffic Rules | TLS in destination rules, system namespace protection |8384## Severity Levels8586| Level | Meaning | Example Issues |87|-------|---------|----------------|88| **Critical** | Immediate security risk | RBAC/ACL disabled, mTLS not enforced, gossip encryption missing |89| **High** | Significant vulnerability | Permissive auth modes, privileged containers, missing hostname verification |90| **Medium** | Security weakness | Default trust domains, long certificate validity, missing telemetry |91| **Low** | Best practice violation | Non-pinned images, missing timeouts, default CA providers |9293## NIST 800-53 Control Mappings9495Findings are mapped to these NIST 800-53 Rev 5 controls:9697| Control | Title | Relevant Checks |98|---------|-------|-----------------|99| AC-3 | Access Enforcement | RBAC, ACL, Authorization policies |100| AC-4 | Information Flow Enforcement | Outbound traffic policy, Policy enforcement |101| AC-17 | Remote Access | mTLS, TLS configuration |102| AU-2 | Audit Events | Telemetry, Access logging |103| AU-3 | Content of Audit Records | Logging configuration |104| AU-12 | Audit Generation | Metrics, Tracing |105| CA-3 | System Interconnections | Trust domain, Peer authentication |106| CM-2 | Baseline Configuration | Proxy config, Default settings |107| CM-6 | Configuration Settings | Security hardening |108| CM-7 | Least Functionality | Privileged mode, Outbound restrictions |109| IA-2 | Identification and Authentication | Service identity, Authentication |110| IA-5 | Authenticator Management | Certificate management, SDS |111| SC-7 | Boundary Protection | Traffic policy, Network segmentation |112| SC-8 | Transmission Confidentiality | mTLS, TLS settings |113| SC-12 | Cryptographic Key Management | Certificate validity, CA settings |114| SC-13 | Cryptographic Protection | Cipher suites, TLS versions |115| SC-23 | Session Authenticity | Peer authentication, Trust chain |116| SI-4 | System Monitoring | Telemetry, Metrics, Tracing |117118## Workflow: Analyze a Mesh Configuration1191201. **Read the configuration file** to understand its structure1212. **Run the analyzer** using the wrapper script1223. **Review findings** by severity (Critical first)1234. **Check NIST mappings** for compliance requirements1245. **Generate remediation** recommendations if needed125126### Example Analysis Session127128```129User: Analyze my Istio mesh configuration at ./istio-config.yaml130131Steps:1321. Read the file to understand the mesh configuration1332. Run: node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-config.yaml1343. Present findings grouped by severity1354. Highlight critical/high severity issues first1365. Include NIST control mappings for compliance context1376. Offer to generate fixes or compliance report138```139140## Output Format141142### Markdown (Default)143144```markdown145## Security Analysis Results146147**Mesh Type:** Istio148**File:** ./istio-config.yaml149**Total Findings:** 5150151| Severity | Count |152|----------|-------|153| Critical | 1 |154| High | 2 |155| Medium | 2 |156| Low | 0 |157158### Critical Findings159160#### 1. mTLS Configuration161**Issue:** mTLS is not set to STRICT mode162**Location:** `spec.mtls.mode`163**Recommendation:** Set mTLS mode to STRICT to enforce mutual TLS164**NIST Controls:** SC-8, SC-13165```166167### JSON (--json flag)168169```json170{171 "success": true,172 "meshType": "istio",173 "findings": [...],174 "summary": { "critical": 1, "high": 2, "medium": 2, "low": 0, "total": 5 }175}176```177178## Related Skills179180- **mesh-remediation** - Generate and apply security fixes181- **mesh-compliance-reporter** - Generate FedRAMP/NIST compliance reports182183## Programmatic Usage184185```javascript186const { analyzeConfig, formatFindings } = require('~/.claude/skills/mesh-security/lib/analyzer-wrapper.js');187188// Analyze a config file189const results = analyzeConfig('./istio-config.yaml');190console.log(formatFindings(results));191192// Or specify mesh type explicitly193const consulResults = analyzeConfig('./config.json', 'consul');194```
diegosouzapw