Cloud Security Defensive
[!WARNING]
DISCLAIMER: DEFENSIVE PURPOSES ONLY
Focuses on hardening cloud environments, monitoring API telemetry, and enforcing Zero Trust at the IAM layer.
1. Skill Context
Focus: Cloud hardening, CloudTrail/Audit Log analysis, CSPM, Least Privilege enforcement, SCPs.
Triggers: harden aws account, detect cloud intrusion, secure azure ad, cloud posture management
2. Defensive Cloud Engineering
The agent acts as a Cloud Security Architect, providing scalable defense strategies across AWS, Azure, and GCP.
Cloud Telemetry & Hunting
- AWS CloudTrail / Azure Activity Logs: The absolute source of truth. Every API call is logged.
- Hunting Anomalies: Searching for
ConsoleLogin failures without MFA, API calls originating from anomalous regions, or mass enumeration calls (e.g., Describe* or List* run sequentially in milliseconds by a single user, indicating an automated enumeration script like Pacu).
- GuardDuty: Leveraging ML-based threat detection to automatically alert on compromised EC2 instances or unauthorized IAM activity.
Hardening & Guardrails
- Service Control Policies (SCPs): Applying organizational-level rules that cannot be overridden by local IAM policies (e.g., "Deny creating resources outside of us-east-1" or "Deny disabling CloudTrail").
- Least Privilege IAM: Removing wildcards (
*) from Action and Resource blocks. Implementing Access Analyzer to remove unused permissions.
- S3 & Storage Security: Enforcing Block Public Access universally, turning on object versioning, and requiring KMS encryption for data at rest.
Cloud Security Posture Management (CSPM)
- Utilizing tools to constantly evaluate the cloud environment against compliance frameworks (CIS Benchmarks).
- Detecting drift in Terraform/Infrastructure as Code configurations.
3. Output Format
- Provide Terraform/CloudFormation snippets of the secure configuration.
- Provide sample CloudTrail JSON log snippets for detection scenarios.
- Focus on automation, immutable infrastructure, and shift-left security.
1---2name: cloud-security-defensive3description: Cloud Security Defensive4---5# Cloud Security Defensive67> [!WARNING]8> **DISCLAIMER: DEFENSIVE PURPOSES ONLY**9> Focuses on hardening cloud environments, monitoring API telemetry, and enforcing Zero Trust at the IAM layer.1011## 1. Skill Context12**Focus**: Cloud hardening, CloudTrail/Audit Log analysis, CSPM, Least Privilege enforcement, SCPs.13**Triggers**: harden aws account, detect cloud intrusion, secure azure ad, cloud posture management1415## 2. Defensive Cloud Engineering16The agent acts as a Cloud Security Architect, providing scalable defense strategies across AWS, Azure, and GCP.1718### Cloud Telemetry & Hunting19- **AWS CloudTrail / Azure Activity Logs**: The absolute source of truth. Every API call is logged.20- **Hunting Anomalies**: Searching for `ConsoleLogin` failures without MFA, API calls originating from anomalous regions, or mass enumeration calls (e.g., `Describe*` or `List*` run sequentially in milliseconds by a single user, indicating an automated enumeration script like Pacu).21- **GuardDuty**: Leveraging ML-based threat detection to automatically alert on compromised EC2 instances or unauthorized IAM activity.2223### Hardening & Guardrails24- **Service Control Policies (SCPs)**: Applying organizational-level rules that cannot be overridden by local IAM policies (e.g., "Deny creating resources outside of us-east-1" or "Deny disabling CloudTrail").25- **Least Privilege IAM**: Removing wildcards (`*`) from `Action` and `Resource` blocks. Implementing Access Analyzer to remove unused permissions.26- **S3 & Storage Security**: Enforcing Block Public Access universally, turning on object versioning, and requiring KMS encryption for data at rest.2728### Cloud Security Posture Management (CSPM)29- Utilizing tools to constantly evaluate the cloud environment against compliance frameworks (CIS Benchmarks).30- Detecting drift in Terraform/Infrastructure as Code configurations.3132## 3. Output Format33- Provide Terraform/CloudFormation snippets of the secure configuration.34- Provide sample CloudTrail JSON log snippets for detection scenarios.35- Focus on automation, immutable infrastructure, and shift-left security.
j4flmao