infra-security

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Infrastructure-as-Code Security Scanner

IaC 安全扫描器

This skill turns the model into a cloud security auditor. Read the IaC, find the dangerous misconfigurations, and report each one with a severity and a concrete fix. The analysis runs entirely against files on disk — no live cloud, no credentials, no

apply

The rules encode the consensus from the CIS Benchmarks, AWS Well-Architected, the Kubernetes Pod Security Standards, and the checks that tools like

tfsec

trivy

checkov

kube-score

, and

cfn-nag

ship — applied as a source read rather than another scanner to wire up.

此 skill 将模型变成云安全审计员。读取 IaC，找出危险的错误配置，并为每项问题报告严重性和具体修复方案。分析完全针对磁盘上的文件运行——不访问实时云环境、不使用凭证、不执行

apply

。

这些规则编码了 CIS Benchmarks、AWS Well-Architected、Kubernetes Pod Security Standards 的共识，以及

tfsec

trivy

、

checkov

、

kube-score

和

cfn-nag

等工具所提供的检查项——以直接读取源文件的方式应用，而不是再接入一个扫描器。

How it works: two stages

工作原理：两个阶段

This skill is deliberately split, the same way

skill-security

is.

Stage 1 — the scanner (deterministic, mechanical).
```
scripts/scan.py
```
does the fast, high-recall work: it walks the target, classifies each file by format, and runs line-oriented detectors for the misconfigurations that are unambiguous in text (
```
0.0.0.0/0
```
on port 22,
```
Action: "*"
```
,
```
privileged: true
```
,
```
runAsUser: 0
```
, a public-read S3 ACL). It is offline and dependency-free — pure Python standard library, no
```
pip install
```
, no
```
hcl2
```
, no
```
pyyaml
```
. It emits findings with
```
file:line
```
and a CI-friendly exit code.
Stage 2 — you (semantic, judgment). The scanner cannot reason about blast radius or compensating controls. You can. You read the flagged resources alongside the rest of the IaC and decide what the scanner cannot: is that
```
0.0.0.0/0
```
actually reachable, or fronted by a WAF? Does that wildcard IAM policy attach to an internet-facing instance, turning a P1 into a P0? Is the "missing" encryption set by a default elsewhere in the module? Stage 1 finds candidates; you confirm impact, suppress false positives, and catch the judgment-only misconfigs (least-privilege gaps, a missing resource, cross-resource chains) that no regex can see.

The scanner is high-recall, not high-precision on purpose. Trust its

file:line

anchors; apply your own judgment to severity and validity.

此 skill 特意拆分为两个阶段，与

skill-security

相同。

阶段 1 — 扫描器（确定性、机械式）。
```
scripts/scan.py
```
负责快速、高召回率的工作：遍历目标，按格式对每个文件分类，并针对文本中明确无误的错误配置运行逐行检测器（22 端口上的
```
0.0.0.0/0
```
、
```
Action: "*"
```
、
```
privileged: true
```
、
```
runAsUser: 0
```
、S3 公共读 ACL）。它完全离线且无依赖——仅使用纯 Python 标准库，无需
```
pip install
```
、无需
```
hcl2
```
或
```
pyyaml
```
。输出结果包含
```
file:line
```
，并提供适合 CI 使用的退出码。
阶段 2 — 你（语义判断）。 扫描器无法推理 blast radius 或 compensating controls。你可以。读取已标记资源及其余 IaC，并判断扫描器无法判断的事项：该
```
0.0.0.0/0
```
实际是否可达，或前方是否有 WAF？通配符 IAM policy 是否附加到面向互联网的实例上，从而把 P1 变成 P0？“缺失”的加密是否由模块其他位置的默认值设置？阶段 1 找出候选项；你确认影响、抑制误报，并发现只能靠判断识别的错误配置（最小权限缺口、缺失资源、跨资源链），这些是任何 regex 都无法发现的。

扫描器有意采用高召回率，而非高精确率。信任其

file:line

锚点；由你自行判断严重性和有效性。

Mental model

思维模型

Misconfiguration risk is exposure × blast radius, not a checklist tick.

Exposure — can an attacker reach it? Internet-facing (
```
0.0.0.0/0
```
, public ACL, public subnet) is the top of the funnel. Internal-only, behind a private subnet or an authn proxy, is far lower.
Blast radius — if reached, what falls? A wildcard IAM policy on a bastion is bad; the same policy on a role assumed by every Lambda is a takeover. Encryption-off on a scratch bucket is P3; on the bucket holding PII it is P1.

The same literal pattern can be P0 or P3 depending on these two axes — which is exactly why the scanner proposes and you decide. When you genuinely cannot tell the blast radius from the IaC alone, say so and rate conservatively with the assumption stated.

错误配置风险是暴露面 × blast radius，而不是勾选清单。

Exposure（暴露面） — 攻击者能否触达？面向互联网（
```
0.0.0.0/0
```
、公共 ACL、公共子网）是漏斗顶端。仅限内部、位于私有子网或 authn proxy 之后，风险要低得多。
blast radius（影响范围） — 如果被触达，会造成什么后果？bastion 上的通配符 IAM policy 很糟糕；同一个 policy 挂到每个 Lambda 都会代入的 role 上，就可能导致全面接管。临时 bucket 关闭加密是 P3；存放 PII 的 bucket 则是 P1。

同一字面模式可能是 P0，也可能是 P3，取决于这两个维度——这正是扫描器负责提出候选项、你负责裁决的原因。当确实无法仅凭 IaC 判断 blast radius 时，应明确说明，并基于明确列出的假设保守评级。

Workflow

工作流

Three phases, in order.

三个阶段，按顺序执行。

Phase 1 — Discover and ingest

阶段 1 — 发现与读取

Run the scanner over the target to get the candidate findings and a file inventory:

bash

python3 scripts/scan.py <target-dir> --format markdown

It classifies files by extension and a content peek:

Terraform —
```
.tf
```
,
```
.tfvars
```
,
```
.hcl
```

CloudFormation / SAM —

.yaml

.yml

.json

with

AWSTemplateFormatVersion

or a

Resources:

map of

AWS::*

types

Kubernetes / Helm —
```
.yaml
```
/
```
.yml
```
with
```
apiVersion:
```
and
```
kind:
```
(multi-document streams split on
```
---
```
)
Docker —
```
Dockerfile*
```
,
```
docker-compose*.yml
```

Use

--format json

when you want to fold the findings into your own reasoning programmatically;

--severity P0,P1

to focus; the scanner exits

when any P0/P1 is present (so it gates a pipeline) and

otherwise.

运行扫描器，获取候选发现和文件清单：

bash

python3 scripts/scan.py <target-dir> --format markdown

它根据扩展名和内容预览对文件分类：

Terraform —
```
.tf
```
、
```
.tfvars
```
、
```
.hcl
```
CloudFormation / SAM — 包含
```
AWSTemplateFormatVersion
```
或由
```
AWS::*
```
类型组成的
```
Resources:
```
映射的
```
.yaml
```
/
```
.yml
```
/
```
.json
```
Kubernetes / Helm — 包含
```
apiVersion:
```
和
```
kind:
```
的
```
.yaml
```
/
```
.yml
```
（按
```
---
```
拆分多文档流）
Docker —
```
Dockerfile*
```
、
```
docker-compose*.yml
```

当需要以编程方式将发现纳入自己的推理时，使用

--format json

；使用

--severity P0,P1

聚焦特定严重性；存在任何 P0/P1 时扫描器退出码为

（因此可用于 pipeline 门禁），否则为

。

Phase 2 — Evaluate by category

阶段 2 — 按类别评估

Take the scanner's candidates and read the surrounding IaC. Walk the categories in

references/controls.md

, confirming impact and looking for the judgment-only gaps the scanner can't:

Identity & Access (IAM) — wildcard
```
Action
```
/
```
Resource
```
,
```
*
```
principals in resource policies, over-broad roles attached to compute, missing least privilege, hardcoded credentials.
Network & Firewall —
```
0.0.0.0/0
```
to sensitive ports (22, 3389, 3306, 5432, 6379, 27017, 9200), databases in public subnets, unnecessary open egress, missing WAF on internet-facing endpoints.
Storage & Data — public S3 ACLs/policies, encryption-at-rest disabled (S3/EBS/RDS/DynamoDB), versioning/logging off on sensitive buckets, public snapshots.
Compute & Containers — privileged containers, running as root, no
```
readOnlyRootFilesystem
```
,
```
hostNetwork
```
/
```
hostPID
```
/
```
hostIPC
```
, the Docker socket mounted in, missing resource limits.
Secrets & Encryption — plaintext secrets in variables/env/ConfigMaps, missing TLS, wildcard KMS key policies.
Logging & Monitoring — CloudTrail/Config/VPC Flow Logs disabled, missing log retention or encryption.
Supply chain — images on
```
:latest
```
or from untrusted registries, Terraform modules from unpinned git/HTTP sources.

For each candidate, the deciding question is the mental model: what is the exposure, and what is the blast radius? That is what turns a raw pattern match into a rated finding.

读取扫描器的候选项和周围的 IaC。逐一走查

references/controls.md

中的类别，确认影响，并查找扫描器无法发现的判断型缺口：

身份与访问（IAM） — 通配
```
Action
```
/
```
Resource
```
、资源 policy 中的
```
*
```
principal、附加到计算资源的过度宽泛 role、缺少最小权限、硬编码凭证。
网络与防火墙 —
```
0.0.0.0/0
```
访问敏感端口（22、3389、3306、5432、6379、27017、9200）、公共子网中的数据库、不必要的开放出站、面向互联网的端点缺少 WAF。
存储与数据 — 公共 S3 ACL/policy、关闭静态加密（S3/EBS/RDS/DynamoDB）、敏感 bucket 未启用版本控制/日志、公共 snapshot。
计算与容器 — 特权容器、以 root 运行、未设置
```
readOnlyRootFilesystem
```
、
```
hostNetwork
```
/
```
hostPID
```
/
```
hostIPC
```
、挂载 Docker socket、缺少资源限制。
Secret 与加密 — 变量/环境/ConfigMap 中的明文 secret、缺少 TLS、通配 KMS key policy。
日志与监控 — CloudTrail/Config/VPC Flow Logs 被禁用、缺少日志保留或加密。
供应链 — 使用
```
:latest
```
镜像或来自不可信 registry 的镜像、Terraform module 来自未固定版本的 git/HTTP 源。

对于每个候选项，决定性问题都是这个思维模型：暴露面是什么，blast radius 是什么？ 正是这一步将原始模式匹配转化为带评级的发现。

Phase 3 — Report and remediate

阶段 3 — 报告与修复

For every confirmed finding, produce:

Severity (P0–P3, see
```
references/severity-rubric.md
```
)
Resource and file:line
Current code — the verbatim bad snippet
Fixed code — the corrected snippet (patterns in
```
references/remediation-playbook.md
```
)
Rationale — the exposure and blast radius, in one or two sentences
Compliance mapping — SOC-2 / PCI-DSS / ISO-27001 control IDs where applicable
Effort — Quick Fix / Moderate / Complex

Assemble these into the report in

references/report-template.md

. Default save path:

./infra-audit-report-<timestamp>.md

对于每项确认的发现，输出：

严重性（P0–P3，参见
```
references/severity-rubric.md
```
）
资源和 file:line
当前代码 — 逐字呈现的错误代码片段
修正代码 — 修正后的代码片段（模式见
```
references/remediation-playbook.md
```
）
理由 — 用一两句话说明暴露面与 blast radius
合规映射 — 适用时给出 SOC-2 / PCI-DSS / ISO-27001 控制项 ID
工作量 — Quick Fix / Moderate / Complex

按

references/report-template.md

中的结构整理报告。默认保存路径：

./infra-audit-report-<timestamp>.md

。

Finding format

发现格式

When reporting inline (not the full document), use this structure. Group by severity, P0 first.

[P0] network-ssh-world-open in infra/sg.tf:24
  aws_security_group.web allows 0.0.0.0/0 to port 22. Any host on the
  internet can reach SSH; combined with the public subnet on this SG,
  the blast radius is full shell access to the instance.

  Current:
    ingress {
      from_port   = 22
      to_port     = 22
      cidr_blocks = ["0.0.0.0/0"]
    }

  Fix (scope to the bastion / VPN CIDR, or use SSM Session Manager):
    ingress {
      from_port   = 22
      to_port     = 22
      cidr_blocks = [var.admin_cidr]   # e.g. ["10.0.0.0/16"]
    }

If the user pastes a snippet without a path, refer to "the resource" and use line numbers within the snippet. Always name the exposure and the blast radius — that pair is the justification for the severity.

在不生成完整文档、而是进行内联报告时，使用以下结构。按严重性分组，首先列出 P0。

[P0] network-ssh-world-open in infra/sg.tf:24
  aws_security_group.web allows 0.0.0.0/0 to port 22. Any host on the
  internet can reach SSH; combined with the public subnet on this SG,
  the blast radius is full shell access to the instance.

  Current:
    ingress {
      from_port   = 22
      to_port     = 22
      cidr_blocks = ["0.0.0.0/0"]
    }

  Fix (scope to the bastion / VPN CIDR, or use SSM Session Manager):
    ingress {
      from_port   = 22
      to_port     = 22
      cidr_blocks = [var.admin_cidr]   # e.g. ["10.0.0.0/16"]
    }

如果用户粘贴的代码片段没有路径，请引用“该资源”，并使用片段内的行号。始终明确指出 exposure 和 blast radius——二者共同构成严重性评级的依据。

Severity scale

严重性等级

Summary only — full criteria, the deployment risk rating, and the effort scale are in

references/severity-rubric.md

P0 Critical — exploitable now from the internet with high blast radius: unauthenticated data exposure or infrastructure takeover. Blocks deployment.
P1 High — privilege escalation, lateral movement, or significant data exposure (often one precondition away from P0). Requires owner review before merge.
P2 Medium — defense-in-depth gap; exploitable under specific conditions. Tracked as tech debt.
P3 Low — best-practice deviation or compliance gap with no direct exploit.
Informational — architectural recommendation or documentation note; no security impact on its own.

仅作摘要——完整标准、部署风险评级和工作量标准位于

references/severity-rubric.md

。

P0 严重（Critical） — 当前可从互联网利用且 blast radius 很大：未认证的数据暴露或基础设施接管。阻止部署。
P1 高危（High） — 权限提升、横向移动或重大数据暴露（通常距离 P0 仅差一个前置条件）。合并前需要所有者审查。
P2 中危（Medium） — 纵深防御缺口；在特定条件下可利用。作为技术债跟踪。
P3 低危（Low） — 偏离最佳实践或存在合规缺口，无直接可利用路径。
提示性（Informational） — 架构建议或文档说明；本身没有安全影响。

When it looks clean

未发现问题的情况

After walking all categories, if nothing fires:

Say so explicitly. "No findings against the standard control set."
Note what was not checked: live cloud state and drift (the deployed resource may differ from this IaC), evaluated IAM permissions (the scanner reads policy documents, not the effective access graph), runtime container behavior, secrets injected outside the IaC, and anything in modules/charts not present in the scanned tree.
Recommend the user confirm against the deployed environment — a clean IaC read does not prove the running infrastructure is safe.

走查完所有类别后，如果没有任何问题触发：

明确说明：“根据标准控制集未发现问题。”
说明未检查的内容：实时云状态和 drift（已部署资源可能与此 IaC 不同）、实际生效的 IAM 权限（扫描器读取的是 policy 文档，而不是有效访问图）、运行时容器行为、在 IaC 之外注入的 secret，以及扫描目录树中不存在的 module/chart 里的任何内容。
建议用户对照已部署环境进行确认——IaC 读取结果干净，并不能证明运行中的基础设施安全。

Safety and guardrails

安全与护栏

Read-only against files. Never run
```
terraform apply
```
/
```
plan -out
```
,
```
kubectl apply
```
,
```
helm install
```
,
```
aws cloudformation deploy
```
, or
```
docker build/run
```
to "validate" a finding. This skill reasons about the IaC text, nothing more.
No credentialed access. Do not read
```
~/.aws/credentials
```
,
```
~/.kube/config
```
, environment secrets, or call any cloud API to confirm a finding.
Deterministic rules first. Severity decisions trace back to
```
references/controls.md
```
. Model judgment is for blast radius, false-positive suppression, and rationale — not for inventing rules.
False-positive reduction. Flag a finding only when the bad pattern is present and no compensating control is visible in the same scope (e.g. an explicit
```
aws_s3_bucket_public_access_block
```
, a default that sets encryption, a WAF in front of the open port). When a compensating control might exist outside the scanned tree, note the assumption.
Redact secrets. If the IaC contains live secrets, redact them in the report rather than echoing them.

对文件只读。 绝不运行
```
terraform apply
```
/
```
plan -out
```
、
```
kubectl apply
```
、
```
helm install
```
、
```
aws cloudformation deploy
```
或
```
docker build/run
```
来“验证”发现。此 skill 只对 IaC 文本进行推理，不做其他操作。
不进行凭证访问。 不读取
```
~/.aws/credentials
```
、
```
~/.kube/config
```
、环境 secret，也不调用任何云 API 来确认发现。
确定性规则优先。 严重性决策必须可追溯到
```
references/controls.md
```
。模型判断用于评估 blast radius、抑制误报和撰写理由——而不是凭空制定规则。
减少误报。 仅当错误模式存在且同一作用域内看不到补偿性控制时，才将其标记为发现（例如显式的
```
aws_s3_bucket_public_access_block
```
、设置加密的默认值、开放端口前方的 WAF）。当补偿性控制可能存在于扫描目录树之外时，应说明相关假设。
脱敏 secret。 如果 IaC 中包含有效 secret，应在报告中脱敏，而不是原样回显。

Trigger phrases

触发短语

Audit this Terraform for security issues: <dir>
Review these Kubernetes manifests before deploy: <dir>
Check this CloudFormation for public S3 buckets: <file>
Is this security group open to the internet?
Is this container running as root / privileged?
Pre-deployment security review of this IaC: <dir>
What's the blast radius if this Terraform is wrong?

Audit this Terraform for security issues: <dir>
Review these Kubernetes manifests before deploy: <dir>
Check this CloudFormation for public S3 buckets: <file>
Is this security group open to the internet?
Is this container running as root / privileged?
Pre-deployment security review of this IaC: <dir>
What's the blast radius if this Terraform is wrong?

Reference files

参考文件

```
references/controls.md
```
— the control catalog: every rule with a stable id, category, severity, the bad and good pattern, and SOC-2/PCI-DSS/ISO-27001 mapping. Read it during Phase 2 to know what to check and how to rate it.
```
references/severity-rubric.md
```
— the P0–P3 + Informational definitions, how to choose between adjacent levels, the deployment risk rating, and the effort scale. Read it when scoring.
```
references/remediation-playbook.md
```
— bad→good fixes for the most common misconfigurations, each with a rationale and the looks-right-but-isn't pitfall. Read it when writing the fix, not just naming the gap.
```
references/report-template.md
```
— the structure of the output audit report. Read it when assembling the final document.

```
references/controls.md
```
— 控制目录：包含每条规则的稳定 ID、类别、严重性、错误模式和正确模式，以及 SOC-2/PCI-DSS/ISO-27001 映射。在阶段 2 阅读它，以了解需要检查什么以及如何评级。
```
references/severity-rubric.md
```
— P0–P3 + Informational 定义、相邻级别之间的选择方式、部署风险评级和工作量标准。评分时阅读。
```
references/remediation-playbook.md
```
— 最常见错误配置的 bad→good 修复方案，每项均包含理由和“看起来正确但实际并非如此”的陷阱。编写修复方案时阅读，而不只是指出缺口。
```
references/report-template.md
```
— 最终审计报告的结构。组装最终文档时阅读。

What this skill won't do

此 skill 不会做什么

It won't run
```
terraform apply
```
,
```
kubectl apply
```
, or deploy anything, and it won't read cloud credentials. The audit is the model reading the IaC plus a stdlib scanner.
It won't require
```
pip install
```
, Docker, or network access. The scanner is standard-library only; if a format needs a real parser to disambiguate, the model reads the file directly.
It won't rate a finding on the literal pattern alone — severity comes from exposure and blast radius, so the same pattern can land anywhere from P0 to P3.
It won't replace a runtime posture tool (CSPM) or a live IAM access analyzer. It checks the IaC before it ships; it cannot see drift or the effective permission graph of the deployed account.
It won't claim "secure" — only "no findings against this control set, and here is what a file read cannot cover."

它不会运行
```
terraform apply
```
、
```
kubectl apply
```
或部署任何内容，也不会读取云凭证。审计由模型读取 IaC，再结合一个 stdlib scanner 完成。
它不要求
```
pip install
```
、Docker 或网络访问。扫描器仅使用 stdlib；如果某种格式需要真正的 parser 才能消歧，模型会直接读取文件。
它不会仅根据字面模式为发现评级——严重性来自 exposure 和 blast radius，因此同一模式可能落在 P0 到 P3 中的任意级别。
它不会替代 runtime posture tool（CSPM）或 live IAM access analyzer。它在发布前检查 IaC；无法看到 drift 或已部署账户的有效权限图。
它不会声称“安全”——只会表示“根据该控制集未发现问题，并说明文件读取无法覆盖哪些内容。”