AWS Security
AWS security service suitability, coverage and cost recommendations: WAF/origin...
Install
npx skills add aws/agent-toolkit-for-aws --skill aws-security -g -a claude-code -y- Repository
- aws/agent-toolkit-for-aws3.4k
- Category
- Security
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
AWS security service suitability, coverage and cost recommendations: WAF/origin overlap, AWS Network Firewall inspection coverage and policy review, VPC endpoint, Transit Gateway/Cloud WAN segmentation and DNS Firewall security-control suitability, certificate renewal ownership and monitoring, incident response triage ownership, centralized security log store (CloudWatch or Security Lake). Also factual configuration, findings, data sources and severity scoring for GuardDuty, Inspector, Security Hub V2/OCSF (Exposure, connectors, automation), Security Hub CSPM/ASFF (standards, controls), Macie, Detective, Security Lake, AWS Security Incident Response membership and case coverage, and Organizations security policies. Applies to advisory security-service choices even when one service is named. Implementation, rule or code authoring, deployment, scans and troubleshooting outside these factual procedures belong to specialist skills. Supports local AWS CLI and AWS MCP.
AWS Security
Use this skill with local AWS CLI or AWS MCP. AWS MCP is recommended for sandboxed execution and audit logging.
Read the relevant bundled procedure before operational guidance. Match intent before service name; reuse an already-read, current copy. For conceptual questions, explain from the relevant reference without AWS account discovery. Live reads require an account assessment request and established scope; an example, prioritization question or suitability question alone does not authorize discovery.
Global rules
-
Read-only APIs only. This skill and all its references use exclusively non-mutating APIs. Never invoke mutating operations or provide write-API commands. Only the selected
service-recommendationsworkflow may advise configuration and lifecycle changes in prose, with a separate implementation handoff for accepted recommendations. It covers focused service suitability and scoped evidence, never rule/code authoring or scan, analysis, query or export initiation. All other procedures report factual state. See the selected reference files for read-only API scope. -
Scoped recommendation priorities. Present configuration state factually outside the selected
service-recommendationsworkflow; do not assign configuration severity, gap assessments, or editorial framing there. Only that workflow may assess coverage gaps and assign recommendation priorities from verified evidence. These priorities are workflow-authored, not observed findings severity or guide-assigned ratings. Preserve service-reported findings severity and the findings ordering below in every workflow. -
No false-positive suppression recommendations. Focus on helping customers understand findings. Do not recommend suppression filters, archival rules, or finding dismissal.
