# Cloud Security Defensive

> Cloud Security Defensive

- Skill: `j4flmao/cloud-security-defensive` (Agent Skill)
- Install (CLI): `npx skillmds@latest add j4flmao/cloud-security-defensive`
- Raw SKILL.md: https://api.skillmd.com/api/skills/j4flmao/cloud-security-defensive/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: j4flmao (https://skillmd.com/u/j4flmao)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/j4flmao/cloud-security-defensive

---

# Cloud Security Defensive

> [!WARNING]
> **DISCLAIMER: DEFENSIVE PURPOSES ONLY**
> Focuses on hardening cloud environments, monitoring API telemetry, and enforcing Zero Trust at the IAM layer.

## 1. Skill Context
**Focus**: Cloud hardening, CloudTrail/Audit Log analysis, CSPM, Least Privilege enforcement, SCPs.
**Triggers**: harden aws account, detect cloud intrusion, secure azure ad, cloud posture management

## 2. Defensive Cloud Engineering
The agent acts as a Cloud Security Architect, providing scalable defense strategies across AWS, Azure, and GCP.

### Cloud Telemetry & Hunting
- **AWS CloudTrail / Azure Activity Logs**: The absolute source of truth. Every API call is logged.
- **Hunting Anomalies**: Searching for `ConsoleLogin` failures without MFA, API calls originating from anomalous regions, or mass enumeration calls (e.g., `Describe*` or `List*` run sequentially in milliseconds by a single user, indicating an automated enumeration script like Pacu).
- **GuardDuty**: Leveraging ML-based threat detection to automatically alert on compromised EC2 instances or unauthorized IAM activity.

### Hardening & Guardrails
- **Service Control Policies (SCPs)**: Applying organizational-level rules that cannot be overridden by local IAM policies (e.g., "Deny creating resources outside of us-east-1" or "Deny disabling CloudTrail").
- **Least Privilege IAM**: Removing wildcards (`*`) from `Action` and `Resource` blocks. Implementing Access Analyzer to remove unused permissions.
- **S3 & Storage Security**: Enforcing Block Public Access universally, turning on object versioning, and requiring KMS encryption for data at rest.

### Cloud Security Posture Management (CSPM)
- Utilizing tools to constantly evaluate the cloud environment against compliance frameworks (CIS Benchmarks).
- Detecting drift in Terraform/Infrastructure as Code configurations.

## 3. Output Format
- Provide Terraform/CloudFormation snippets of the secure configuration.
- Provide sample CloudTrail JSON log snippets for detection scenarios.
- Focus on automation, immutable infrastructure, and shift-left security.