Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    iac security drift reviewer

    1

    Senior platform security reviewer for Terraform and Kubernetes IaC, focusing on misconfigurations and resource drift.

    $16

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    iac security drift reviewer

    iac security drift reviewer

    Example session with this skill installed

    Review this terraform plan output for security risks and drift: [plan text showing an S3 bucket with public_access_block disabled and an out-of-band change adding an IAM policy to a user]

    • Read your context and instructions
    • Compiled the iac security drift

    I have reviewed the Terraform plan output provided. The analysis identified one Critical security misconfiguration and one instance of state-vs-reality drift.

    IaC Security & Drift Review

    Executive Summary

    Risk Posture: High
    Findings: 1 Critical, 1 Medium (Drift)
    Top Risks: Public S3 bucket exposure and unauthorized IAM policy attachment.
    Urgent Action: Enable S3 Public Access Block immediately to prevent data leakage.

    Security Findings

    IDTitleSeverityLocationEvidenceFix
    SEC-01S3 Public Access DisabledCriticals3.tf line 12block_public_acls = falseSet all block_public_* flags to true.

    Drift Register

    ResourceLayerClassificationEvidenceDisposition
    aws_iam_user_policy.extraState vs RealitySecurity-relevantPlan shows +1 policy not in code.Reconcile: Delete or Codify.

    Remediation Plan

    [Priority 1] Secure S3 Bucket: Update aws_s3_bucket_public_access_block in s3.tf. This is an in-place update with no downtime.
    2.

    [Priority 2] Resolve IAM Drift: Investigate if AdminAccess policy was manually attached to deploy-user. If unauthorized, run terraform apply to remove; if valid, import into code.

    Next steps

    • Apply the S3 hardening fix and run terraform plan to verify the diff.
    • Check CloudTrail logs for the Principal ID who attached the IAM policy to deploy-user.
    • Run scripts/iac_quick_scan.py on the full repository to find similar S3 patterns.

    Disclaimer: This review is an automated, evidence-based analysis of the material provided. It is not a penetration test, compliance audit or certification, and it does not guarantee the absence of vulnerabilities or drift. Validate all recommendations in a non-production environment before applying them.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Configuration drift and security holes in IaC go unnoticed until a breach or a failed deployment occurs. This skill provides a senior platform-security review of your infrastructure-as-code to identify weaknesses and synchronization gaps. It analyzes Terraform and Kubernetes configurations against security best practices and live state data.

    What it does

    • Security Audit identifies misconfigurations in IAM, networking, and data storage across Terraform and Kubernetes manifests.
    • Drift Detection compares code against state files and live cluster reality to find out-of-band changes.
    • Evidence-Based Reporting maps every finding to specific files and line numbers to eliminate guesswork.
    • Remediation Planning generates a prioritized list of fixes with impact assessments and rollback steps.
    • Secret Triage scans for hardcoded credentials and recommends rotation without exposing sensitive values.

    How it works

    1. Inventory by listing providers, modules, namespaces, and resources in the provided files.
    2. Scan using a heuristic regex tool to flag potential leads for manual verification.
    3. Analyze against checklists for Terraform security and Kubernetes Pod Security Standards.
    4. Compare code, state, and reality layers to classify drift as security-relevant, operational, or benign.
    5. Report findings using a severity rubric and a structured remediation plan.

    Frameworks & tools

    Works with Terraform, OpenTofu, Kubernetes (YAML, Helm, Kustomize), AWS, Azure, GCP, and GitOps tools like Argo CD and Flux.

    Why this beats prompting it yourself

    Generic prompts often overlook the "three-layer" drift problem between code, state, and reality. This skill follows a strict evidence-only rule and a read-only workflow, ensuring you get actionable technical findings without risking accidental infrastructure changes.

    Use cases

    • Auditing a Terraform repository before a production migration or security review.
    • Debugging "out-of-sync" GitOps resources in Argo CD or Flux.
    • Hardening EKS/GKE clusters by reviewing RBAC and Network Policies.
    • Investigating manual "hotfixes" made in the cloud console that aren't in the code.

    Known limitations

    Does not inspect live clusters directly without provided command output. Cannot access remote modules or state files not explicitly shared. Analysis is limited to provided context.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for DevOps & Cloud.

    Requires manual provision of plan/diff text. Cannot execute changes. Limited to regex pre-scanning and checklist-based review. Does not support non-standard IaC wrappers.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 7 days ago

    Permissions

    Terminal / Shell
    Read Files
    Network Access
    Listed7 days ago

    What's inside

    Frequently Asked Questions

    The skill detects 'Three-Layer Drift' by comparing your static IaC files against state data and live reality, identifying out-of-band changes that generic security scanners often miss.

    It supports Terraform, OpenTofu, and Kubernetes manifests (including Helm and Kustomize), with specific security logic for AWS, Azure, and GCP provider resources.

    No, the skill follows a strict read-only workflow; it identifies risks and provides a prioritized remediation plan with code examples, but it cannot modify your infrastructure.

    You will receive the full agent skill configuration, including the specialized security logic, remediation templates, and instructions for integrating it with your preferred AI agent platform.

    While it cannot browse live clusters on its own, it can analyze command-line output from tools like 'kubectl' or 'terraform plan' if you provide them as context during the session.

    This skill is designed for any LLM-based agent that supports file uploads or long-context windows, such as ChatGPT (GPT-4), Claude 3, or specialized DevOps AI platforms.

    New in DevOps & Cloud