Finding Security Misconfigurations
Overview
Scan infrastructure-as-code templates, application configuration files, and system settings to detect security misconfigurations mapped to OWASP A05:2021 (Security Misconfiguration) and CIS Benchmarks. Cover cloud resources (AWS, GCP, Azure), container orchestration (Kubernetes, Docker), web servers (Nginx, Apache), and application frameworks.
Prerequisites
- Infrastructure-as-code files accessible in
${CLAUDE_SKILL_DIR}/ (Terraform .tf, CloudFormation .yaml/.json, Ansible playbooks, Kubernetes manifests)
- Application configuration files available (
application.yml, config.json, .env.example, web.config)
- Container definitions (
Dockerfile, docker-compose.yml, Helm charts)
- Web server configs (
nginx.conf, httpd.conf, .htaccess) if applicable
- Write permissions for findings output in
${CLAUDE_SKILL_DIR}/security-findings/
- Optional:
tfsec, checkov, or trivy config installed for automated pre-scanning
Instructions
- Discover all configuration files by scanning
${CLAUDE_SKILL_DIR}/ for IaC templates (.tf, .yaml, .json, .template), application configs, container definitions, and web server configs.
- Cloud storage: check for publicly accessible S3 buckets, unencrypted storage accounts, missing versioning, and overly permissive bucket policies (CIS AWS 2.1.1, 2.1.2).
- Network security: flag security groups allowing
0.0.0.0/0 ingress on sensitive ports (22, 3389, 3306, 5432, 27017), missing VPC flow logs, and absent network segmentation.
- IAM and access: detect wildcard (
*) permissions in IAM policies, service accounts with admin privileges, missing MFA enforcement, and hardcoded credentials in source (CWE-798).
- Compute resources: identify EC2/VM instances with unnecessary public IPs, unencrypted volumes, missing IMDSv2 enforcement, and outdated base images.
- Database security: flag publicly accessible RDS/Cloud SQL instances, missing encryption at rest, disabled automated backups, default ports exposed without IP restrictions.
- Application config: detect debug mode enabled in production, default credentials, CORS wildcard (
*), missing CSRF protection, disabled authentication endpoints, and API keys in config files.
- Container security: check for containers running as root, missing resource limits,
privileged: true, writable root filesystems, and images without pinned digests.
- Classify each finding: