Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseOpenClawOpenClaw+21 more

    GovCloud

    1

    Audit and harden Terraform and cloud IaC files by enforcing least-privilege IAM and private network segmentation.

    $9

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    GovCloud

    GovCloud

    Example session with this skill installed

    Review this Terraform snippet for security: resource "aws_iam_role_policy" "test" { policy = jsonencode({ Statement = [{ Action = "", Resource = "", Effect = "Allow" }] }) }

    • Read your context and instructions
    • Compiled the govcloud
    • Generated the document

    I have audited the provided Terraform snippet. The policy contains a critical security violation regarding broad access permissions.

    🚨 GOVCLOUD AUDIT: BROAD DEPLOYMENT BLOCKED

    Violations detected in the proposed layout:

    1. CRITICAL RISK FAILURE: WILDCARD CLOUD ACCESS POLICIES DEPRECATED. The use of Action: "*" and Resource: "*" provides full administrative access, violating the principle of least privilege.
    2. Hardcoded policy detected without resource scoping.

    Hardened Terraform IAM Policy

    
# Scoped IAM role - Replaces wildcard access with specific resource actions
resource "aws_iam_role_policy" "app_specific_access" {
  name = "AppServiceLeastPrivilege"
  role = aws_iam_role.app_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = [
          "s3:GetObject",
          "s3:ListBucket"
        ]
        Resource = [
          "arn:aws:s3:::my-production-app-assets",
          "arn:aws:s3:::my-production-app-assets/*"
        ]
      },
      {
        Effect   = "Allow"
        Action   = [
          "dynamodb:PutItem",
          "dynamodb:GetItem"
        ]
        Resource = "arn:aws:dynamodb:us-east-1:123456789012:table/AppData"
      }
    ]
  })
}

    Next steps

    1. Identify the specific AWS ARNs required for your application to replace the placeholders in the hardened policy.
    2. Apply the scoped policy to your staging environment and monitor for AccessDenied events to ensure all necessary permissions are captured.
    3. Delete the original aws_iam_role_policy.test resource to prevent accidental deployment of the wildcard policy.

    govcloud.pdf

    PDF · document

    Generated

    Example file from a real run - the skill writes it into your workspace.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Block and fix wildcard IAM policies in Terraform manifests.Relocate public-facing databases to isolated private subnets.Replace hardcoded infrastructure secrets with Secrets Manager references.Enforce least-privilege access for EC2 and Lambda execution roles.

    About this skill

    Security gaps in infrastructure-as-code often lead to catastrophic breaches. Manual reviews of Terraform or CloudFormation scripts miss wildcard IAM rules and public-facing data stores, creating silent vulnerabilities in your production environment.

    What it does

    • IAM Wildcard Detection identifies and blocks policies using * actions or resources to prevent over-privileged roles.
    • Network Segmentation Enforcement moves databases, caches, and queues from public subnets to isolated private tiers.
    • Credential Sanitization flags hardcoded secrets and rewrites manifests to use AWS Secrets Manager or HashiCorp Vault.
    • Ingress Filtering audits security groups to ensure sensitive ports like 5432 or 6379 are not open to 0.0.0.0/0.
    • Automated Hardening intercepts unsafe IaC generation and provides a rebuilt, compliant version of the code.

    How it works

    1. Submit your Terraform, CloudFormation, or Kubernetes manifests for a static audit.
    2. The agent parses the files to identify specific security violations and high-risk exposures.
    3. If violations exist, the agent provides a detailed list of risks by file path and line number.
    4. The agent generates a hardened version of the infrastructure code following least-privilege principles.

    Frameworks & tools

    This skill works with Terraform, AWS CloudFormation, Pulumi, and Kubernetes manifests. It specializes in AWS infrastructure hardening including IAM, VPC, RDS, and Security Groups.

    Why this beats prompting it yourself

    Generic prompts often default to "quick start" configurations that prioritize speed over security, like public subnets and admin roles. This skill enforces a zero-trust architecture by default, refusing to output code that contains known cloud security anti-patterns.

    Use cases

    • Reviewing a pull request for a new microservice infrastructure to ensure IAM roles are scoped.
    • Hardening an existing Terraform repo before a SOC2 or security audit.
    • Scaffolding a multi-tier VPC layout that strictly separates public web layers from private data layers.

    Known limitations

    Does not support local-only Docker Compose files. Effectiveness may vary for cloud providers outside of AWS unless the IaC is provided in Terraform format.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean today

    • Passed all security checks, Safe to install

    Listedtoday

    What's inside

    Frequently Asked Questions