<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-cloud-compliance-posture
description: >-
  Audit cloud infrastructure compliance posture across AWS, Azure, and GCP.
  Automate assessment of CIS Benchmarks, security group configurations,
  encryption settings, IAM policies, and logging configurations using
  ScoutSuite, Prowler, and native cloud security services.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - cloud-compliance
  - aws
  - azure
  - gcp
  - cis-benchmarks
  - prowler
  - scoutsuite
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Auditing Cloud Compliance Posture

## Overview

Cloud environments introduce shared responsibility compliance challenges. This
skill automates posture assessment using Prowler (AWS/Azure/GCP), ScoutSuite
(multi-cloud), and native services (AWS Security Hub, Azure Defender, GCP SCC).
Evaluates against CIS Benchmarks, SOC 2, PCI DSS, HIPAA, and GDPR requirements
with automated evidence collection.

Mode: `[MODE: BLUE]` — Cloud security posture assessment and compliance validation.

## Prerequisites

| Requirement | Install |
|---|---|
| Prowler | `pip install prowler` |
| ScoutSuite | `pip install scoutsuite` |
| AWS CLI | `pip install awscli` |
| Azure CLI | `curl -sL https://aka.ms/InstallAzureCLIDeb \| sudo bash` |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Cloud Shared Responsibility Model

```
Customer Responsibility (IN the cloud):
├── Data classification and encryption
├── Identity and access management
├── Application-level security
├── OS patching (IaaS)
├── Network configuration (Security Groups, NACLs)
└── Logging and monitoring configuration

Provider Responsibility (OF the cloud):
├── Physical infrastructure security
├── Hypervisor security
├── Network infrastructure
├── Storage infrastructure
└── Managed service security (PaaS/SaaS layer)
```

### Prowler — AWS CIS Benchmark Scan

```bash
# Full CIS AWS Foundations Benchmark scan
prowler aws --compliance cis_3.0_aws

# Specific service checks
prowler aws --service iam s3 ec2 rds --output-formats json

# Framework-specific scan
prowler aws --compliance pci_3.2.1_aws --output-formats json-ocsf

# Scan with specific profile and region
prowler aws --profile production --region us-east-1 \
  --compliance hipaa_aws --output-formats json

# Azure CIS scan
prowler azure --compliance cis_2.1_azure

# GCP CIS scan
prowler gcp --compliance cis_2.0_gcp
```

### AWS Security Checks

```bash
# S3 bucket public access
aws s3api list-buckets --query 'Buckets[].Name' --output text | \
  xargs -I{} aws s3api get-public-access-block --bucket {} 2>&1

# Unencrypted EBS volumes
aws ec2 describe-volumes --filters Name=encrypted,Values=false \
  --query 'Volumes[].{ID:VolumeId,Size:Size,AZ:AvailabilityZone}'

# Security groups with 0.0.0.0/0 ingress
aws ec2 describe-security-groups \
  --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]]].{ID:GroupId,Name:GroupName}'

# IAM users without MFA
aws iam get-credential-report --output text --query Content | \
  base64 -d | awk -F, '$4=="true" && $8=="false" {print $1}'

# CloudTrail status
aws cloudtrail get-trail-status --name management-trail \
  --query '{Logging:IsLogging,LatestDelivery:LatestDeliveryTime}'

# RDS encryption status
aws rds describe-db-instances \
  --query 'DBInstances[].{ID:DBInstanceIdentifier,Encrypted:StorageEncrypted,Engine:Engine}'
```

### Multi-Cloud Compliance Matrix

| Check | AWS | Azure | GCP |
|---|---|---|---|
| Encryption at rest | EBS/S3/RDS encryption | Disk/Storage encryption | CMEK/default encryption |
| Network isolation | VPC/SG/NACL | VNet/NSG | VPC/Firewall rules |
| IAM MFA | IAM MFA | Conditional Access | 2-Step Verification |
| Audit logging | CloudTrail | Activity Log | Cloud Audit Logs |
| Key management | KMS | Key Vault | Cloud KMS |

## Workflow

### Step 1: Scan Cloud Environment

```bash
node scripts/agent.js --action scan --provider aws --region us-east-1 \
  --compliance cis --output /tmp/cloud-scan.json
```

### Step 2: Assess Compliance Posture

```bash
node scripts/agent.js --action assess --input /tmp/cloud-scan.json \
  --framework pci-dss --output /tmp/cloud-assess.json
```

### Step 3: Generate Remediation Report

```bash
node scripts/agent.js --action report --input /tmp/cloud-assess.json \
  --output /tmp/cloud-remediation.json
```

## Verification

- [ ] All cloud accounts/subscriptions/projects scanned
- [ ] CIS Benchmark score calculated per service category
- [ ] No publicly accessible S3 buckets/storage with sensitive data
- [ ] All EBS/disk volumes encrypted with customer-managed keys
- [ ] IAM MFA enforced for all human users
- [ ] CloudTrail/Activity Log enabled across all regions
- [ ] Security groups restrict ingress to required ports only
- [ ] Root/owner account access restricted with MFA

## References

- [Prowler](https://github.com/prowler-cloud/prowler)
- [ScoutSuite](https://github.com/nccgroup/ScoutSuite)
- [CIS AWS Benchmark](https://www.cisecurity.org/benchmark/amazon_web_services)
- [AWS Security Hub](https://docs.aws.amazon.com/securityhub/)
