How do I install the Iac Security Review skill?

Run npx skillmds@latest add owasp/iac-security-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Iac Security Review safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Iac Security Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Iac Security Review free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under CC-BY-4.

Who published Iac Security Review?

OWASP (@owasp) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Iac Security Review by owasp — Agent Skill

Name: Iac Security Review
Author: OWASP

Iac Security Review

Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation). Use when reviewing IaC files for misconfigurations, overpermissioning, exposed resources, missing encryption, secrets in code, and supply chain risks. Covers CIS benchmarks and cloud security best practices.

OWASP 3b56548 2.7 KB Updated Sep 17, 2026

File contents

IaC Security Review

Review infrastructure-as-code for security risks by following the full procedure in plays/iac-security-review.md.

Steps

Detect IaC Type — Identify the infrastructure technology from file extensions and content:
- .tf / .tofu files → Terraform/OpenTofu (reference data/secure-code-prompts/terraform.md)
- Kubernetes manifests (apiVersion, kind: Deployment/Pod/Service) → Kubernetes (reference data/secure-code-prompts/kubernetes.md)
- CloudFormation templates (AWSTemplateFormatVersion, Resources with AWS::) → CloudFormation (reference data/secure-code-prompts/cloudformation.md)
- Helm charts (Chart.yaml, templates/) → Kubernetes review with Helm-specific checks
Systematic Review by Security Domain (priority order):
- Identity & Access Management — Overly permissive policies, wildcard permissions, hardcoded credentials, privilege escalation paths
- Secrets Management — Hardcoded secrets, plaintext credentials, missing vault/secret manager integration
- Network Security — Open ingress (0.0.0.0/0), unrestricted ports, missing segmentation, public exposure
- Encryption — Missing encryption at rest/in transit, weak algorithms, default keys
- Storage Security — Public buckets, unencrypted volumes, missing versioning
- Logging & Monitoring — Missing audit trails, disabled CloudTrail/audit logging
- Resource Exposure — Databases, admin interfaces, APIs exposed to internet
- Supply Chain — Unpinned versions, untrusted sources, unverified modules/images
- Platform-Specific Risks — Terraform state exposure, K8s privileged containers, CFN nested stack integrity
Check Against Benchmarks — Validate configurations against:
- CIS Benchmarks (AWS/Azure/GCP/Kubernetes)
- Cloud provider security best practices
- Pod Security Standards (for Kubernetes)
Produce Findings — For each finding: cite resource path, explain the misconfiguration, describe attack scenario, provide fixed code example, rate severity.

Output

Findings sorted by severity using templates/finding.md format, summary with severity counts, and secure configuration improvements section.

References

CIS Benchmarks (AWS, Azure, GCP, Kubernetes)
OWASP Infrastructure Security Cheat Sheet
NSA/CISA Kubernetes Hardening Guide
Cloud provider Well-Architected Frameworks

---name: iac-security-reviewdescription: Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation). Use when reviewing IaC files for misconfigurations, overpermissioning, exposed resources, missing encryption, secrets in code, and supply chain risks. Covers CIS benchmarks and cloud security best practices.license: CC-BY-4.0---# IaC Security ReviewReview infrastructure-as-code for security risks by following the full procedure in `plays/iac-security-review.md`.## Steps1. **Detect IaC Type** — Identify the infrastructure technology from file extensions and content: - `.tf` / `.tofu` files → Terraform/OpenTofu (reference `data/secure-code-prompts/terraform.md`) - Kubernetes manifests (apiVersion, kind: Deployment/Pod/Service) → Kubernetes (reference `data/secure-code-prompts/kubernetes.md`) - CloudFormation templates (AWSTemplateFormatVersion, Resources with AWS::) → CloudFormation (reference `data/secure-code-prompts/cloudformation.md`) - Helm charts (`Chart.yaml`, templates/) → Kubernetes review with Helm-specific checks2. **Systematic Review by Security Domain** (priority order): - **Identity & Access Management** — Overly permissive policies, wildcard permissions, hardcoded credentials, privilege escalation paths - **Secrets Management** — Hardcoded secrets, plaintext credentials, missing vault/secret manager integration - **Network Security** — Open ingress (`0.0.0.0/0`), unrestricted ports, missing segmentation, public exposure - **Encryption** — Missing encryption at rest/in transit, weak algorithms, default keys - **Storage Security** — Public buckets, unencrypted volumes, missing versioning - **Logging & Monitoring** — Missing audit trails, disabled CloudTrail/audit logging - **Resource Exposure** — Databases, admin interfaces, APIs exposed to internet - **Supply Chain** — Unpinned versions, untrusted sources, unverified modules/images - **Platform-Specific Risks** — Terraform state exposure, K8s privileged containers, CFN nested stack integrity3. **Check Against Benchmarks** — Validate configurations against: - CIS Benchmarks (AWS/Azure/GCP/Kubernetes) - Cloud provider security best practices - Pod Security Standards (for Kubernetes)4. **Produce Findings** — For each finding: cite resource path, explain the misconfiguration, describe attack scenario, provide fixed code example, rate severity.## OutputFindings sorted by severity using `templates/finding.md` format, summary with severity counts, and secure configuration improvements section.## References- CIS Benchmarks (AWS, Azure, GCP, Kubernetes)- OWASP Infrastructure Security Cheat Sheet- NSA/CISA Kubernetes Hardening Guide- Cloud provider Well-Architected Frameworks

Frequently asked questions