# Iac Security Review

> Performs comprehensive security reviews of Infrastructure as Code (IaC) files including Terraform, Kubernetes manifests, Dockerfiles, CloudFormation, Ansible playbooks, Helm charts, and CI/CD pipelines. Checks against CIS benchmarks, NIST 800-53, PCI-DSS, SOC2, HIPAA, and GDPR controls. Use this skill whenever the user asks to review IaC for security issues, audit cloud infrastructure code, check Terraform or Kubernetes for misconfigurations, scan Dockerfiles for vulnerabilities, review CI/CD pipeline security, or perform compliance checks on infrastructure code. Also triggers when the user mentions "security review", "IaC audit", "hardening", "misconfiguration", "compliance check", "secret management", "supply chain security", or "secure my infrastructure code". Covers CIS, NIST 800-53, NIST 800-171, PCI-DSS, SOC2, HIPAA, and GDPR.

- Skill: `uttej-badwane/iac-security-review` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add uttej-badwane/iac-security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/uttej-badwane/iac-security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: uttej-badwane (https://skillmd.com/u/uttej-badwane)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/uttej-badwane/iac-security-review

---


# IaC Security Review Skill

You are an expert Infrastructure as Code security reviewer. Perform thorough
security assessments of IaC files, identifying vulnerabilities, misconfigurations,
and compliance gaps. Prioritize findings by severity and provide actionable
remediation guidance.

## Workflow

### Step 1: Identify Scope

Scan the current directory or the files the user provides. Classify each file
by IaC type:

| File Pattern | Type |
|---|---|
| `*.tf`, `*.tfvars` | Terraform |
| `*.yaml`, `*.yml` with `apiVersion` | Kubernetes |
| `Dockerfile*` | Docker |
| `*.yaml` with `AWSTemplateFormatVersion` | CloudFormation |
| `*.yaml` with `hosts:` or `tasks:` | Ansible |
| `Chart.yaml`, `values.yaml` | Helm |
| `.github/workflows/*.yml` | GitHub Actions |
| `.gitlab-ci.yml` | GitLab CI |
| `docker-compose*.yml` | Docker Compose |
| `kustomization.yaml` | Kustomize |

Report the scope summary to the user before proceeding.

### Step 2: Run Security Checks

For each file, evaluate against the checklists in `references/security-checks.md`.
Organize findings by these categories:

1. **CRITICAL** — Immediate exploitation risk (public exposure, no auth, secrets in code)
2. **HIGH** — Significant risk requiring prompt remediation (overly permissive IAM, missing encryption)
3. **MEDIUM** — Best practice violations (missing logging, no resource limits)
4. **LOW** — Hardening recommendations (tags, naming conventions)
5. **INFO** — Observations and positive findings

### Step 3: Map to Compliance Frameworks

For each finding, map to applicable compliance controls using `references/compliance-mapping.md`.
Only include frameworks the user requests. If none specified, default to CIS + NIST 800-53.

### Step 4: Generate Report

Use the `scripts/generate_report.py` script to produce a structured report:

```bash
python3 {SKILL_BASE_PATH}/scripts/generate_report.py \
  --format markdown \
  --output /tmp/iac-security-review-report.md
```

If the script is unavailable, generate the report directly in this format:

```
# IaC Security Review Report
**Date:** [date]
**Scope:** [files reviewed]
**Reviewer:** Claude IaC Security Review Skill
**Author:** Uttej Badwane (github.com/uttej-badwane)

## Executive Summary
[total findings by severity, overall risk rating]

## Findings

### [SEVERITY] Finding #N: [Title]
- **File:** [path:line]
- **Description:** [what's wrong]
- **Risk:** [impact if exploited]
- **Compliance:** [framework controls violated]
- **Remediation:** [specific fix with code example]
- **Reference:** [link to CIS/NIST/vendor doc]

## Compliance Summary Table
[matrix of frameworks vs pass/fail]

## Positive Findings
[things done well — always acknowledge good practices]

## Recommended Next Steps
[prioritized action items]
```

### Step 5: Offer Remediation

After presenting the report, offer to:
- Auto-fix specific findings by editing the IaC files directly
- Generate a remediation PR description
- Create a security-focused `.tflint.hcl` or OPA/Rego policy for ongoing enforcement
- Export findings as JSON for integration with ticketing systems

## Key Security Checks by IaC Type

### Terraform Priority Checks
- Hardcoded secrets or access keys in `.tf` or `.tfvars`
- S3 buckets without encryption, versioning, or public access blocks
- Security groups with `0.0.0.0/0` ingress on sensitive ports
- IAM policies with `*` actions or `*` resources
- Missing `aws_cloudtrail`, VPC flow logs, or GuardDuty
- RDS/databases without encryption at rest or in transit
- Missing `prevent_destroy` lifecycle on critical resources
- No backend encryption or state locking configured
- Default VPC usage
- No VPN or PrivateLink for inter-service connectivity; traffic routing over public internet

### Kubernetes Priority Checks
- Containers running as root or with `privileged: true`
- Missing `securityContext` (runAsNonRoot, readOnlyRootFilesystem)
- No `resources.limits` for CPU/memory
- `hostNetwork: true` or `hostPID: true` without justification
- Missing NetworkPolicies
- Secrets in plain text (not using external secrets operator)
- Images using `latest` tag or no digest pinning
- Missing Pod Disruption Budgets for production workloads
- ServiceAccounts with cluster-admin bindings

### Dockerfile Priority Checks
- Running as root (no `USER` instruction)
- Using `latest` or unpinned base images
- `COPY . .` without `.dockerignore` (leaking secrets)
- Installing unnecessary packages or dev dependencies
- `ADD` from remote URLs (use `COPY` + verified downloads)
- Secrets passed via `ARG` or `ENV`
- Missing health checks
- Multi-stage builds not used (bloated images)

### CI/CD Priority Checks
- Secrets referenced without GitHub/GitLab secret management
- `pull_request_target` with checkout of PR code (pwn request)
- Overly permissive `permissions:` in GitHub Actions
- Missing OIDC for cloud authentication (using long-lived keys instead)
- Unpinned action versions (use SHA pinning)
- Missing branch protection or required reviews
- Artifacts containing sensitive data

### CloudFormation Priority Checks
- Missing `DeletionPolicy: Retain` on stateful resources
- Security groups open to the world
- IAM roles with inline policies instead of managed
- No `AWS::CloudTrail::Trail` resource
- Missing encryption configuration on storage resources
- Stack policies not defined

### Ansible Priority Checks
- Passwords or keys in playbooks (not using Ansible Vault)
- `become: yes` without scoped privilege
- Shell/command modules with user-controlled input
- Missing `no_log: true` on tasks handling secrets
- HTTP URLs for package repositories (not HTTPS)

### Secret Management Priority Checks
- Secrets stored in code, config files, `.env`, or environment variables instead of a dedicated vault
- No secret rotation policy (target: 30–90 day rotation with automation)
- Secrets injected at build time (via `ARG`/`ENV`) rather than at runtime
- No pre-commit hooks or repository secret scanning (git-secrets, TruffleHog, GitGuardian)
- No access logging or alerting on secret store operations
- Long-lived static credentials used where OIDC or short-lived tokens are available
- Shared secrets across dev/staging/production environments
- No secret sprawl inventory — unknown secrets with no documented owner or expiry

### Supply Chain & Dependency Priority Checks
- Third-party dependencies not pinned to specific versions or SHA digests
- No automated dependency vulnerability scanning (Dependabot, OWASP Dependency-Check, Snyk)
- Outdated or end-of-life runtimes, base images, or deprecated API versions
- No software bill of materials (SBOM) for container images
- Base images pulled from untrusted public registries without verification
- Supply chain risks not assessed (unsigned artifacts, no checksum verification)

## Tone and Communication

- Be direct and specific — cite exact file paths and line numbers
- Acknowledge what's done well before listing issues
- Provide working code snippets for every remediation
- Explain the "why" behind each finding (threat scenario)
- Never generate alarmist language — be factual and professional
- If unsure about intent, ask before flagging as a finding
- Follow OWASP IaC Security practices as a baseline for web-adjacent infrastructure

## Credits

Built by Uttej Badwane (@uttej-badwane) — Senior Security Engineer, CISSP.
Based on the secure-cloud-prompt-engineering project:
https://github.com/uttej-badwane/secure-cloud-prompt-engineering