AuditClaw AWS
Companion skill for auditclaw-grc. Collects compliance evidence from AWS accounts using read-only API calls.
15 checks | Read-only IAM policy | Evidence stored in shared GRC database
Security Model
- Read-only access: Custom IAM policy with 43 read-only API actions. No write/modify/delete permissions.
- Credentials: Uses standard AWS credential chain (
aws configure, env vars, or IAM instance role). No credentials stored by this skill.
- Dependencies:
boto3==1.34.46 (pinned)
- Data flow: Check results stored as evidence in
~/.openclaw/grc/compliance.sqlite via auditclaw-grc
Prerequisites
- AWS credentials configured (
aws configure or IAM instance role)
pip install -r scripts/requirements.txt- auditclaw-grc skill installed and initialized
Commands
- "Run AWS evidence sweep": Run all checks, store results in GRC database
- "Check S3 encryption": Run S3-specific checks
- "Check IAM compliance": Run IAM-specific checks
- "Check CloudTrail status": Verify CloudTrail configuration
- "Check VPC security": Review VPC flow logs and security groups
- "Show AWS integration health": Last sync, errors, evidence count
Usage
All evidence is stored in the shared GRC database at ~/.openclaw/grc/compliance.sqlite
via the auditclaw-grc skill's db_query.py script.
To run a full evidence sweep:
python3 scripts/aws_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --all
To run specific checks:
python3 scripts/aws_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --checks iam,s3,cloudtrail
Check Categories (15)
| Check |
What It Verifies |
| iam |
Password policy, MFA enforcement, access key rotation, unused credentials |
| s3 |
Default encryption, public access blocks, versioning, access logging |
| cloudtrail |
Trail enabled, multi-region, log validation, S3 delivery |
| vpc |
Flow logs enabled, security group rules, NACL configuration |
| kms |
Key rotation enabled, key policies, key usage |
| ec2 |
IMDSv2 enforcement, EBS encryption, public IP exposure |
| rds |
Storage encryption, automated backups, public accessibility |
| security_hub |
Security Hub enabled, active findings by severity |
| guardduty |
Detector enabled, active findings, threat intelligence |
| lambda |
Runtime currency, public access, VPC attachment |
| cloudwatch |
Log group retention policies, metric alarm coverage |
| config |
Config recorder active, rule compliance status |
| eks_ecs |
Container cluster encryption, logging, network policies |
| elb |
HTTPS listeners, WAF association, access logging |
| credential_report |
Full IAM credential report analysis |
Evidence Storage
Each check produces evidence items stored with:
source: "aws"type: "automated"control_id: Mapped to relevant SOC2/ISO/HIPAA controlsdescription: Human-readable finding summaryfile_content: JSON details of the check result
IAM Policy
See scripts/iam-policy.json for the minimum IAM permissions needed.
Use the principle of least privilege; the policy uses read-only permissions only.
Setup Guide
When a user asks to set up AWS integration, guide them through these steps:
Step 1: Create IAM Policy
Direct the user to AWS Console → IAM → Policies → Create Policy → JSON tab.
The exact policy is in scripts/iam-policy.json. Show it with:
python3 {baseDir}/../auditclaw-grc/scripts/db_query.py --action show-policy --provider aws
The policy contains 43 read-only API actions across 14 AWS services. No write/modify/delete permissions.
Step 2: Create IAM User
Name: auditclaw-scanner. Attach the AuditClawReadOnly policy.
CLI: aws iam create-user --user-name auditclaw-scanner
Step 3: Generate Access Keys
Security Credentials → Create Access Key → CLI use case.
CLI: aws iam create-access-key --user-name auditclaw-scanner
Step 4: Configure Credentials
Store credentials: aws configure or set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY env vars.
Step 5: Verify Connection
Run: python3 {baseDir}/scripts/aws_evidence.py --test-connection
This probes each AWS service and reports accessibility.
Do NOT recommend SecurityAudit or ViewOnlyAccess managed policies. They grant far more access than needed. Always use our custom policy from scripts/iam-policy.json.
1---2name: auditclaw-aws3description: AWS compliance evidence collection for auditclaw-grc. 15 read-only checks across S3, IAM, CloudTrail, VPC, KMS, EC2, RDS, Lambda, EBS, SQS, SNS, Secrets Manager, Config, GuardDuty, and Security Hub.4---5# AuditClaw AWS
6
7Companion skill for auditclaw-grc. Collects compliance evidence from AWS accounts using read-only API calls.
8
9**15 checks | Read-only IAM policy | Evidence stored in shared GRC database**
10
11## Security Model
12- **Read-only access**: Custom IAM policy with 43 read-only API actions. No write/modify/delete permissions.
13- **Credentials**: Uses standard AWS credential chain (`aws configure`, env vars, or IAM instance role). No credentials stored by this skill.
14- **Dependencies**: `boto3==1.34.46` (pinned)
15- **Data flow**: Check results stored as evidence in `~/.openclaw/grc/compliance.sqlite` via auditclaw-grc
16
17## Prerequisites
18- AWS credentials configured (`aws configure` or IAM instance role)
19- `pip install -r scripts/requirements.txt`
20- auditclaw-grc skill installed and initialized
21
22## Commands
23- "Run AWS evidence sweep": Run all checks, store results in GRC database
24- "Check S3 encryption": Run S3-specific checks
25- "Check IAM compliance": Run IAM-specific checks
26- "Check CloudTrail status": Verify CloudTrail configuration
27- "Check VPC security": Review VPC flow logs and security groups
28- "Show AWS integration health": Last sync, errors, evidence count
29
30## Usage
31All evidence is stored in the shared GRC database at ~/.openclaw/grc/compliance.sqlite
32via the auditclaw-grc skill's db_query.py script.
33
34To run a full evidence sweep:
35```
36python3 scripts/aws_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --all
37```
38
39To run specific checks:
40```
41python3 scripts/aws_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --checks iam,s3,cloudtrail
42```
43
44## Check Categories (15)
45
46| Check | What It Verifies |
47|-------|-----------------|
48| **iam** | Password policy, MFA enforcement, access key rotation, unused credentials |
49| **s3** | Default encryption, public access blocks, versioning, access logging |
50| **cloudtrail** | Trail enabled, multi-region, log validation, S3 delivery |
51| **vpc** | Flow logs enabled, security group rules, NACL configuration |
52| **kms** | Key rotation enabled, key policies, key usage |
53| **ec2** | IMDSv2 enforcement, EBS encryption, public IP exposure |
54| **rds** | Storage encryption, automated backups, public accessibility |
55| **security_hub** | Security Hub enabled, active findings by severity |
56| **guardduty** | Detector enabled, active findings, threat intelligence |
57| **lambda** | Runtime currency, public access, VPC attachment |
58| **cloudwatch** | Log group retention policies, metric alarm coverage |
59| **config** | Config recorder active, rule compliance status |
60| **eks_ecs** | Container cluster encryption, logging, network policies |
61| **elb** | HTTPS listeners, WAF association, access logging |
62| **credential_report** | Full IAM credential report analysis |
63
64## Evidence Storage
65Each check produces evidence items stored with:
66- `source: "aws"`
67- `type: "automated"`
68- `control_id`: Mapped to relevant SOC2/ISO/HIPAA controls
69- `description`: Human-readable finding summary
70- `file_content`: JSON details of the check result
71
72## IAM Policy
73See `scripts/iam-policy.json` for the minimum IAM permissions needed.
74Use the principle of least privilege; the policy uses read-only permissions only.
75
76## Setup Guide
77
78When a user asks to set up AWS integration, guide them through these steps:
79
80### Step 1: Create IAM Policy
81Direct the user to AWS Console → IAM → Policies → Create Policy → JSON tab.
82The exact policy is in `scripts/iam-policy.json`. Show it with:
83 python3 {baseDir}/../auditclaw-grc/scripts/db_query.py --action show-policy --provider aws
84
85The policy contains 43 read-only API actions across 14 AWS services. No write/modify/delete permissions.
86
87### Step 2: Create IAM User
88Name: `auditclaw-scanner`. Attach the AuditClawReadOnly policy.
89CLI: `aws iam create-user --user-name auditclaw-scanner`
90
91### Step 3: Generate Access Keys
92Security Credentials → Create Access Key → CLI use case.
93CLI: `aws iam create-access-key --user-name auditclaw-scanner`
94
95### Step 4: Configure Credentials
96Store credentials: `aws configure` or set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY env vars.
97
98### Step 5: Verify Connection
99Run: `python3 {baseDir}/scripts/aws_evidence.py --test-connection`
100This probes each AWS service and reports accessibility.
101
102**Do NOT recommend SecurityAudit or ViewOnlyAccess managed policies.** They grant far more access than needed. Always use our custom policy from `scripts/iam-policy.json`.
modbender