ops-aws-audit

Agent Skills › Lifecycle-Innovations-Limited/claude-ops › ops-aws-audit

ops-aws-audit

GitHub

执行只读AWS账户审计，检查IAM、EC2、RDS等安全基线及成本优化，生成分级报告。支持多区域扫描与定时任务，仅发现不自动清理，用于定期合规审查。

claude-ops/skills/ops-aws-audit/SKILL.md Lifecycle-Innovations-Limited/claude-ops

Trigger Scenarios

进行AWS安全扫描检查账户资源闲置情况分析云资源成本支出执行定期账户健康检查

Install

npx skills add Lifecycle-Innovations-Limited/claude-ops --skill ops-aws-audit -g -y

More Options

Non-standard path

npx skills add https://github.com/Lifecycle-Innovations-Limited/claude-ops/tree/main/claude-ops/skills/ops-aws-audit -g -y

Use without installing

npx skills use Lifecycle-Innovations-Limited/claude-ops@ops-aws-audit

指定 Agent (Claude Code)

npx skills add Lifecycle-Innovations-Limited/claude-ops --skill ops-aws-audit -a claude-code -g -y

安装 repo 全部 skill

npx skills add Lifecycle-Innovations-Limited/claude-ops --all -g -y

预览 repo 内 skill

npx skills add Lifecycle-Innovations-Limited/claude-ops --list

SKILL.md

Frontmatter

{
    "name": "ops-aws-audit",
    "effort": "medium",
    "maxTurns": 30,
    "description": "Read-only AWS account hygiene audit — security baseline, unused\/orphaned resources, and cost optimization across all configured regions. Produces severity-ranked findings (CRITICAL→LOW) plus a machine-readable findings.json. Cleanup actions are always human-gated, never automatic. Use for cost reviews, security sweeps, recurring account hygiene, or \"audit my AWS\".",
    "allowed-tools": [
        "Bash",
        "Read",
        "Grep",
        "Glob",
        "AskUserQuestion",
        "WebSearch",
        "WebFetch"
    ],
    "argument-hint": "[--quiet] [--schedule] [region,region]"
}

What this does

Runs scripts/ops-aws-audit.sh — a read-only sweep that never mutates AWS. It inventories and analyses, then writes a severity-ranked report.

Checks include (2026 baseline):

IAM / credentials — root access key + root MFA, access keys older than AUDIT_KEY_AGE_DAYS (default 90), console users without MFA, and whether an IAM Access Analyzer (UNUSED_ACCESS) is configured.
EC2 / EBS — unattached volumes, gp2→gp3 candidates, unencrypted volumes, unassociated Elastic IPs, security groups open to 0.0.0.0/0 on SSH/RDP.
RDS — unencrypted or publicly-accessible instances, and orphaned manual snapshots whose source DB no longer exists.
S3 — account-level Block Public Access, per-bucket default encryption and lifecycle policies.
CloudWatch Logs — log groups with no retention (billed forever).
Lambda — deprecated/old runtimes.
Security posture — GuardDuty, Security Hub standards, Cost Anomaly Detection monitors, Compute Optimizer enrollment.
Cost — per-service Usage spend (RECORD_TYPE=Usage UnblendedCost) over the last AUDIT_COST_DAYS with the Δ vs the prior window. Credits mask net CE totals to ≈ $0 — this audit never uses unfiltered Blended/Unblended nets as burn.

Configuration (env, all optional)

Var	Default	Meaning
`AUDIT_PROFILE`	(unset)	Named AWS profile. Unset ⇒ standard chain (env keys / instance role / SSO).
`AUDIT_REGIONS`	`$AWS_REGION` or `us-east-1`	Comma-separated regions.
`AUDIT_OUTPUT_DIR`	`~/.aws-audit-history/audit-<ts>`	Where reports land.
`AUDIT_KEY_AGE_DAYS`	`90`	Active access-key age threshold.
`AUDIT_COST_DAYS`	`7`	Cost comparison window.

How to run

# one region, current account
bash "${CLAUDE_PLUGIN_ROOT}/scripts/ops-aws-audit.sh"

# multi-region + named profile
AUDIT_PROFILE=prod AUDIT_REGIONS=us-east-1,eu-central-1 \
  bash "${CLAUDE_PLUGIN_ROOT}/scripts/ops-aws-audit.sh"

Outputs in AUDIT_OUTPUT_DIR: report.md (human), findings.json (machine), raw/ (per-service snapshots + cost-delta.tsv), audit.log.

After the run, read findings.json and summarise CRITICAL/HIGH first.

Recurring schedule

--schedule installs a daily systemd --user timer via scripts/install-aws-audit-cron.sh (Linux; this box uses systemd, not launchd):

bash "${CLAUDE_PLUGIN_ROOT}/scripts/install-aws-audit-cron.sh"
systemctl --user list-timers ops-aws-audit.timer

Dispatch to the background fleet instead:

claude --bg --name aws-audit -- bash "${CLAUDE_PLUGIN_ROOT}/scripts/ops-aws-audit.sh" --quiet

Cleanup is human-gated (never automatic)

This skill only audits. To act on a finding:

Show the user the specific finding(s) and the exact aws command(s).
Get explicit per-batch approval (ok / yes / proceed).
For any deletion/rotation, snapshot state first; log resource IDs after.
Root access keys can only be removed from a root console login — flag it, do not attempt to "rotate root" from an IAM-user CLI session (that only rotates the IAM user's own key, not the root key).