aws-security

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

AWS Security

STOP — Do not answer from general knowledge. Before responding to any security service question, match the user's request against the sub-skill registry below and follow its procedure. If the procedure says to load a reference file, you MUST read it before providing operational guidance. Never skip the routing step.

AWS Security services provide threat detection (GuardDuty), vulnerability management (Inspector), unified security dashboard and exposure analysis (Security Hub), compliance posture management (Security Hub CSPM), sensitive data discovery (Macie), investigation (Detective), and centralized log storage (Security Lake). Each service has dedicated reference procedures for configuration review and findings/investigation summarization.

This skill works with or without the AWS MCP server. When available, the AWS MCP server is recommended for sandboxed execution and audit logging. Procedures use standard AWS CLI syntax (

aws <service> <command>

See

references/services-overview.md

for service relationships, data formats, and cross-service integration patterns.

注意——请勿凭常识作答。 在回应任何安全服务相关问题前，请将用户请求与下方的子技能注册表进行匹配，并遵循对应的流程。如果流程要求加载参考文件，您必须先阅读文件再提供操作指导。切勿跳过路由步骤。

AWS安全服务提供威胁检测（GuardDuty）、漏洞管理（Inspector）、统一安全仪表板与暴露分析（Security Hub）、合规态势管理（Security Hub CSPM）、敏感数据发现（Macie）、调查（Detective）以及集中式日志存储（Security Lake）功能。每项服务都有专门的参考流程，用于配置审查和检测结果/调查摘要生成。

该技能可在有或无AWS MCP服务器的情况下使用。如果可用，推荐使用AWS MCP服务器进行沙箱执行和审计日志记录。操作流程采用标准AWS CLI语法（

aws <service> <command>

）。

如需了解服务关系、数据格式和跨服务集成模式，请查看

references/services-overview.md

。

Global rules

全局规则

Read-only APIs only. This skill and all its references use exclusively non-mutating APIs. NEVER reference, recommend, or invoke any API that creates, modifies, deletes, enables, disables, or otherwise mutates resource state or configuration — not even in prose recommendations. See service reference files for the complete allowed API list.
No severity judgements on configuration state. Present what is and is not configured factually. Do not assign severity labels, gap assessments, or editorial framing (e.g., "critical gap", "security issue") to configuration state.
No false-positive suppression recommendations. Focus on helping customers understand findings. Do not recommend suppression filters, archival rules, or finding dismissal.
Prioritize Attack Sequences in GuardDuty. Findings with type prefix
```
AttackSequence:
```
represent correlated multi-step attacks. Always surface these first, before severity breakdown.
Prioritize Exposure findings in Security Hub. Exposure findings (attack paths, resource exposure) represent Security Hub's unique cross-service correlation. Surface these first in any findings summary.
Expensive operations require explicit request. MUST NOT paginate through all member accounts by default. Per-account enumeration only executes if the user explicitly requests detailed account-level information. Use statistics/count APIs where available (e.g.,
```
get-coverage-statistics
```
).
Match the user's language. Respond in the same language the user writes in.
Verify, don't guess. If you cannot confirm a fact from a reference file or API output, say so.
Sensitive data disclosure. When a procedure produces output that may contain sensitive information (full finding bodies, IP addresses, resource identifiers, network configurations, threat intelligence details), present a summary first. Note what sensitive data the full output contains. Display the complete raw response only when the caller explicitly requests it.

仅使用只读API。本技能及其所有参考文件仅使用非变更类API。绝对不要引用、推荐或调用任何会创建、修改、删除、启用、禁用或以其他方式变更资源状态或配置的API——即使是在书面建议中也不行。允许使用的完整API列表请查看服务参考文件。
不对配置状态做严重性判断。如实呈现已配置和未配置的内容。不要为配置状态分配严重性标签、差距评估或编辑性描述（例如“关键差距”“安全问题”）。
不建议误报抑制。专注于帮助客户理解检测结果。不要建议使用抑制过滤器、归档规则或驳回检测结果。
优先处理GuardDuty中的攻击序列。类型前缀为
```
AttackSequence:
```
的检测结果代表关联的多步骤攻击。在进行严重性细分前，务必优先展示这些结果。
优先处理Security Hub中的暴露检测结果。暴露检测结果（攻击路径、资源暴露）是Security Hub独特的跨服务关联功能。在任何检测结果摘要中，务必优先展示这些结果。
高成本操作需明确请求。默认情况下，不得遍历所有成员账户。仅当用户明确请求详细的账户级信息时，才执行按账户枚举操作。尽可能使用统计/计数API（例如
```
get-coverage-statistics
```
）。
匹配用户语言。使用与用户提问相同的语言进行回应。
验证而非猜测。如果无法从参考文件或API输出中确认事实，请如实说明。
敏感数据披露。当流程生成的输出可能包含敏感信息（完整检测结果内容、IP地址、资源标识符、网络配置、威胁情报详情）时，先呈现摘要。说明完整输出包含哪些敏感数据。仅当调用者明确请求时，才显示完整的原始响应。

How this skill works

技能工作流程

Find the sub-skill — Match the user's request against the sub-skill registry below. Match on meaning, not exact wording. If ambiguous, ask: "Are you checking configuration, or do you need a findings summary?"
If a sub-skill matches — read
```
references/{sub-skill-id}.md
```
and follow its procedure.
If no sub-skill matches — answer from the service reference files listed below. Load
```
references/services-overview.md
```
for cross-service context, or the relevant service reference file (e.g.,
```
references/guardduty.md
```
) for API scope and severity scoring questions.
Cross-service overview — When the user asks about overall security posture across multiple services, start with
```
references/services-overview.md
```
, then route to relevant sub-skills.

查找子技能——将用户请求与下方的子技能注册表进行匹配。根据含义匹配，而非精确措辞。如果存在歧义，请询问：“您是要检查配置，还是需要检测结果摘要？”
如果匹配到子技能——阅读
```
references/{sub-skill-id}.md
```
并遵循其流程。
如果未匹配到子技能——从下方列出的服务参考文件中获取答案。如需跨服务上下文，请加载
```
references/services-overview.md
```
；如需API范围和严重性评分相关问题，请加载相关服务参考文件（例如
```
references/guardduty.md
```
）。
跨服务概述——当用户询问多个服务的整体安全态势时，先从
```
references/services-overview.md
```
开始，再路由到相关子技能。

Sub-skill registry

子技能注册表

ID	Name	Trigger Phrases	When to Route Here	Reference
`guardduty-configuration`	GuardDuty Config Review	"is GuardDuty configured", "check detector", "GuardDuty features enabled", "runtime monitoring setup"	User wants to verify GuardDuty deployment completeness	`references/guardduty-configuration.md`
`guardduty-findings`	GuardDuty Findings Summary	"summarize GuardDuty findings", "what threats", "GuardDuty severity breakdown", "attack sequences"	User wants a findings posture snapshot	`references/guardduty-findings.md`
`inspector-configuration`	Inspector Config Review	"is Inspector scanning", "Inspector enabled", "scan types", "coverage gaps"	User wants to verify Inspector deployment	`references/inspector-configuration.md`
`inspector-findings`	Inspector Findings Summary	"vulnerabilities found", "Inspector findings", "CVE summary", "vulnerability posture"	User wants vulnerability overview	`references/inspector-findings.md`
`security-hub-configuration`	Security Hub Config Review	"Security Hub integrations", "aggregation configured", "connectors", "automation rules", "V2 automation rules", "OCSF automation rules"	User wants to verify Security Hub V2 (OCSF) setup	`references/security-hub-configuration.md`
`security-hub-findings`	Security Hub Findings Summary	"risk overview", "exposure findings", "attack paths", "OCSF findings", "security posture trends"	User wants Security Hub V2 (OCSF) findings overview	`references/security-hub-findings.md`
`security-hub-cspm-configuration`	CSPM Config Review	"standards enabled", "controls", "FSBP", "CIS", "PCI-DSS", "NIST", "compliance setup", "AI security", "AI best practices", "CSPM automation rules", "ASFF automation rules"	User wants to verify compliance standards setup	`references/security-hub-cspm-configuration.md`
`security-hub-cspm-findings`	CSPM Compliance Summary	"compliance posture", "failed controls", "pass rate", "ASFF findings", "third-party findings"	User wants compliance findings overview	`references/security-hub-cspm-findings.md`
`macie-configuration`	Macie Config Review	"Macie configured", "data discovery setup", "classification jobs", "Macie enabled"	User wants to verify Macie deployment	`references/macie-configuration.md`
`macie-findings`	Macie Findings Summary	"sensitive data found", "Macie findings", "data classification results", "PII detected"	User wants sensitive data overview	`references/macie-findings.md`
`detective-configuration`	Detective Config Review	"Detective configured", "behavior graph", "Detective members", "data sources"	User wants to verify Detective deployment	`references/detective-configuration.md`
`detective-investigations`	Detective Investigations Summary	"Detective investigations", "investigation status", "indicators", "finding groups"	User wants investigation landscape overview	`references/detective-investigations.md`
`security-lake-configuration`	Security Lake Config Review	"Security Lake configured", "log sources enabled", "subscribers", "data lake setup"	User wants to verify Security Lake deployment	`references/security-lake-configuration.md`
`security-lake-sources`	Security Lake Sources Summary	"what's flowing into Security Lake", "ingestion status", "source health", "data lake exceptions"	User wants data lake health overview	`references/security-lake-sources.md`
`organization-policies`	Organization Policies Review	"organization policies", "org policies", "SECURITYHUB_POLICY", "INSPECTOR_POLICY", "list-policies", "policy targets", "policy enforcement"	User wants to review or discover AWS Organizations service policies	`references/organization-policies.md`

ID	名称	触发短语	适用场景	参考文档
`guardduty-configuration`	GuardDuty配置审查	"GuardDuty是否已配置"、"检查检测器"、"GuardDuty功能是否启用"、"运行时监控设置"	用户想要验证GuardDuty部署的完整性	`references/guardduty-configuration.md`
`guardduty-findings`	GuardDuty检测结果摘要	"汇总GuardDuty检测结果"、"有哪些威胁"、"GuardDuty严重性细分"、"攻击序列"	用户想要获取检测结果态势快照	`references/guardduty-findings.md`
`inspector-configuration`	Inspector配置审查	"Inspector是否在扫描"、"Inspector是否启用"、"扫描类型"、"覆盖差距"	用户想要验证Inspector部署情况	`references/inspector-configuration.md`
`inspector-findings`	Inspector检测结果摘要	"发现的漏洞"、"Inspector检测结果"、"CVE摘要"、"漏洞态势"	用户想要获取漏洞概况	`references/inspector-findings.md`
`security-hub-configuration`	Security Hub配置审查	"Security Hub集成"、"聚合配置"、"连接器"、"自动化规则"、"V2自动化规则"、"OCSF自动化规则"	用户想要验证Security Hub V2（OCSF）的设置	`references/security-hub-configuration.md`
`security-hub-findings`	Security Hub检测结果摘要	"风险概述"、"暴露检测结果"、"攻击路径"、"OCSF检测结果"、"安全态势趋势"	用户想要获取Security Hub V2（OCSF）检测结果概况	`references/security-hub-findings.md`
`security-hub-cspm-configuration`	CSPM配置审查	"标准是否启用"、"控制措施"、"FSBP"、"CIS"、"PCI-DSS"、"NIST"、"合规设置"、"AI安全"、"AI最佳实践"、"CSPM自动化规则"、"ASFF自动化规则"	用户想要验证合规标准的设置	`references/security-hub-cspm-configuration.md`
`security-hub-cspm-findings`	CSPM合规摘要	"合规态势"、"未通过控制项"、"通过率"、"ASFF检测结果"、"第三方检测结果"	用户想要获取合规检测结果概况	`references/security-hub-cspm-findings.md`
`macie-configuration`	Macie配置审查	"Macie是否已配置"、"数据发现设置"、"分类任务"、"Macie是否启用"	用户想要验证Macie部署情况	`references/macie-configuration.md`
`macie-findings`	Macie检测结果摘要	"发现的敏感数据"、"Macie检测结果"、"数据分类结果"、"检测到PII"	用户想要获取敏感数据概况	`references/macie-findings.md`
`detective-configuration`	Detective配置审查	"Detective是否已配置"、"行为图谱"、"Detective成员"、"数据源"	用户想要验证Detective部署情况	`references/detective-configuration.md`
`detective-investigations`	Detective调查摘要	"Detective调查"、"调查状态"、"指标"、"检测结果组"	用户想要获取调查概况	`references/detective-investigations.md`
`security-lake-configuration`	Security Lake配置审查	"Security Lake是否已配置"、"日志源是否启用"、"订阅者"、"数据湖设置"	用户想要验证Security Lake部署情况	`references/security-lake-configuration.md`
`security-lake-sources`	Security Lake源数据摘要	"哪些数据流入Security Lake"、" ingestion状态"、"源健康状况"、"数据湖异常"	用户想要获取数据湖健康状况概况	`references/security-lake-sources.md`
`organization-policies`	组织策略审查	"组织策略"、"org策略"、"SECURITYHUB_POLICY"、"INSPECTOR_POLICY"、"list-policies"、"策略目标"、"策略执行"	用户想要查看或发现AWS Organizations服务策略	`references/organization-policies.md`

Disambiguation

歧义消除

Keywords	Route to
"automation rules" (ambiguous)	Both Security Hub and Security Hub CSPM have automation rules. If customer uses Security Hub V2 (OCSF), route to Security Hub config. If customer uses Security Hub CSPM (ASFF), route to CSPM config. Ask if unclear.
"standards", "controls", "compliance", "FSBP", "CIS", "PCI", "NIST", "ASFF"	Security Hub CSPM skills
"integrations", "risk score", "attack path", "OCSF", "exposure", "connectors"	Security Hub skills
"threat detection", "GuardDuty", "detector", "runtime monitoring", "attack sequence"	GuardDuty skills
"vulnerability", "CVE", "Inspector", "scanning", "code vulnerability"	Inspector skills
"sensitive data", "classification", "Macie", "PII", "data discovery"	Macie skills
"investigation", "behavior graph", "Detective", "indicators"	Detective skills
"data lake", "log sources", "Security Lake", "subscribers", "ingestion"	Security Lake skills
"organization policies", "org policies", "policy type", "list-policies --filter"	Organization Policies (cross-service)

Note: If a customer is using Security Hub V2 (OCSF), they should use Security Hub automation rules (

list-automation-rules-v2

) and should NOT use Security Hub CSPM features for new rules, even though CSPM remains technically available.

关键词	路由至
"automation rules"（歧义）	Security Hub和Security Hub CSPM都有自动化规则。如果客户使用Security Hub V2（OCSF），路由至Security Hub配置；如果客户使用Security Hub CSPM（ASFF），路由至CSPM配置。若不确定，请询问。
"standards"、"controls"、"compliance"、"FSBP"、"CIS"、"PCI"、"NIST"、"ASFF"	Security Hub CSPM技能
"integrations"、"risk score"、"attack path"、"OCSF"、"exposure"、"connectors"	Security Hub技能
"threat detection"、"GuardDuty"、"detector"、"runtime monitoring"、"attack sequence"	GuardDuty技能
"vulnerability"、"CVE"、"Inspector"、"scanning"、"code vulnerability"	Inspector技能
"sensitive data"、"classification"、"Macie"、"PII"、"data discovery"	Macie技能
"investigation"、"behavior graph"、"Detective"、"indicators"	Detective技能
"data lake"、"log sources"、"Security Lake"、"subscribers"、"ingestion"	Security Lake技能
"organization policies"、"org policies"、"policy type"、"list-policies --filter"	组织策略（跨服务）

注意： 如果客户使用Security Hub V2（OCSF），应使用Security Hub自动化规则（

list-automation-rules-v2

），且不应使用Security Hub CSPM功能创建新规则，尽管CSPM在技术上仍可用。

Service reference

服务参考

Load service reference files on demand — only when the current turn requires context about service capabilities, API scope, or severity scoring.

Reference	Content	When to Load
`references/services-overview.md`	Cross-service relationships, data formats, membership models, admin discovery, API conventions	Cross-service questions, general security posture, "which services should I enable"
`references/guardduty.md`	GuardDuty APIs, severity scoring, service notes	GuardDuty-specific questions about APIs or severity
`references/inspector.md`	Inspector APIs, severity scoring, service notes	Inspector-specific questions about APIs or severity
`references/security-hub.md`	Security Hub V2 (OCSF) APIs, severity scoring, service notes	Security Hub V2-specific questions about APIs or severity
`references/security-hub-cspm.md`	Security Hub CSPM (V1/ASFF) APIs, severity scoring, service notes	CSPM-specific questions about APIs or severity
`references/macie.md`	Macie APIs, severity scoring, service notes	Macie-specific questions about APIs or severity
`references/detective.md`	Detective APIs, severity scoring, service notes	Detective-specific questions about APIs or severity
`references/security-lake.md`	Security Lake APIs, service notes	Security Lake-specific questions about APIs
`references/organization-policies.md`	Organization policies discovery pattern, policy types, Organizations APIs	Questions about org-level policy enforcement across security services

按需加载服务参考文件——仅当当前对话需要了解服务能力、API范围或严重性评分相关上下文时才加载。

参考文档	内容	加载时机
`references/services-overview.md`	跨服务关系、数据格式、成员模型、管理员发现、API约定	跨服务问题、通用安全态势问题、“我应该启用哪些服务”
`references/guardduty.md`	GuardDuty API、严重性评分、服务说明	GuardDuty特定的API或严重性相关问题
`references/inspector.md`	Inspector API、严重性评分、服务说明	Inspector特定的API或严重性相关问题
`references/security-hub.md`	Security Hub V2（OCSF）API、严重性评分、服务说明	Security Hub V2特定的API或严重性相关问题
`references/security-hub-cspm.md`	Security Hub CSPM（V1/ASFF）API、严重性评分、服务说明	CSPM特定的API或严重性相关问题
`references/macie.md`	Macie API、严重性评分、服务说明	Macie特定的API或严重性相关问题
`references/detective.md`	Detective API、严重性评分、服务说明	Detective特定的API或严重性相关问题
`references/security-lake.md`	Security Lake API、服务说明	Security Lake特定的API相关问题
`references/organization-policies.md`	组织策略发现模式、策略类型、Organizations API	跨安全服务的组织级策略执行相关问题

Security considerations

安全注意事项

Logging and monitoring: Verify CloudTrail is enabled for security service and Organizations API calls, CloudTrail log file validation is active, and CloudWatch metric filters or alarms exist for anomalous privileged read patterns such as unexpected volume, unusual principals, or unexpected regions.
Encryption and destinations: Verify publishing or export destinations such as S3 buckets, SNS topics, and CloudWatch Logs use KMS encryption at rest and TLS in transit. For downstream S3 or SNS destinations, verify resource policies use
```
aws:SourceArn
```
and
```
aws:SourceAccount
```
condition keys where applicable.
Notification recipients: Verify SNS topic subscriptions and other security alarm recipients are restricted to authorized security personnel, and periodically audit subscription endpoints.
Credential management: Confirm CLI execution is using temporary credentials such as IAM roles or AWS SSO. Verify third-party integration credentials, API tokens, or connector secrets are stored in AWS Secrets Manager or AWS Systems Manager Parameter Store rather than plaintext configuration files or environment variables.
Security references: Consult AWS Security Hub best practices, AWS CloudTrail security best practices, IAM security best practices, and the AWS Well-Architected Security Pillar for current service guidance.
Sensitive data: Security service outputs may contain sensitive information such as IP addresses, resource identifiers, account IDs, vulnerability details, exposure paths, and threat intelligence. Classification and handling requirements are customer-specific; do not store or share outputs in unprotected channels without verifying organizational data handling policies.

日志与监控：验证CloudTrail是否已启用安全服务和Organizations API调用的日志记录，CloudTrail日志文件验证是否处于活动状态，以及是否存在针对异常特权读取模式（如意外流量、异常主体或意外区域）的CloudWatch指标过滤器或警报。
加密与目标：验证S3存储桶、SNS主题和CloudWatch Logs等发布或导出目标是否在静态时使用KMS加密，传输时使用TLS。对于下游S3或SNS目标，验证资源策略是否在适用情况下使用
```
aws:SourceArn
```
和
```
aws:SourceAccount
```
条件键。
通知接收者：验证SNS主题订阅和其他安全警报接收者是否仅限于授权安全人员，并定期审核订阅端点。
凭证管理：确认CLI执行使用临时凭证，如IAM角色或AWS SSO。验证第三方集成凭证、API令牌或连接器密钥是否存储在AWS Secrets Manager或AWS Systems Manager Parameter Store中，而非明文配置文件或环境变量。
安全参考：查阅AWS Security Hub最佳实践、AWS CloudTrail安全最佳实践、IAM安全最佳实践以及AWS架构完善框架安全支柱获取最新服务指导。
敏感数据：安全服务输出可能包含敏感信息，如IP地址、资源标识符、账户ID、漏洞详情、暴露路径和威胁情报。分类和处理要求因客户而异，未经验证组织的数据处理策略，请勿在未受保护的渠道中存储或共享输出。