Infrastructure Compliance Auditor
Cross-cutting infrastructure security audit across ALL compliance frameworks. Replaces manual Vanta-style checks with deterministic, repeatable, evidence-generating infrastructure audits covering cloud, DNS, TLS, endpoints, access control, network, containers, CI/CD, secrets, logging, and physical security.
Table of Contents
- [Trigger Phrases](#trigger-phrases)
- [Quick Start](#quick-start)
- [Tools](#tools)
- [Audit Domains](#audit-domains)
- [1. Cloud Infrastructure Security](#1-cloud-infrastructure-security)
- [2. DNS Security](#2-dns-security)
- [3. TLS/SSL Security](#3-tlsssl-security)
- [4. Endpoint Security](#4-endpoint-security)
- [5. Access Control and Authentication](#5-access-control-and-authentication)
- [6. Network Security](#6-network-security)
- [7. Container and Kubernetes Security](#7-container-and-kubernetes-security)
- [8. CI/CD Pipeline Security](#8-cicd-pipeline-security)
- [9. Secrets Management](#9-secrets-management)
- [10. Logging and Monitoring](#10-logging-and-monitoring)
- [11. Physical Security](#11-physical-security)
- [12. Compliance Framework Mapping](#12-compliance-framework-mapping)
- [Workflows](#workflows)
- [Reference Guides](#reference-guides)
- [Validation Checkpoints](#validation-checkpoints)
- [Scoring Methodology](#scoring-methodology)
Trigger Phrases
Use this skill when you hear:
- "infrastructure audit"
- "cloud security audit"
- "infrastructure compliance"
- "DNS security audit"
- "TLS audit"
- "endpoint security"
- "access control audit"
- "network security assessment"
- "infrastructure security"
- "cloud compliance"
- "Vanta alternative"
- "compliance automation"
- "security posture assessment"
- "hardware security keys"
- "YubiKey compliance"
Quick Start
Run Full Infrastructure Audit
python scripts/infra_audit_runner.py --config infrastructure.json --output audit_report.jsonAudit DNS Security for a Domain
python scripts/dns_security_checker.py --domain example.com --output dns_report.jsonAudit Access Controls
python scripts/access_control_auditor.py --config access_controls.json --output access_report.jsonGenerate Compliance-Mapped Report
python scripts/infra_audit_runner.py --config infrastructure.json --frameworks soc2,iso27001,hipaa --format markdown --output compliance_report.mdTools
| Tool | Purpose | Input | |------|---------|-------| | infra_audit_runner.py | Full infrastructure audit across all 11 domains | JSON config describing infrastructure | | dns_security_checker.py | DNS-specific security audit (SPF, DKIM, DMARC, DNSSEC, CAA, MTA-STS) | Domain name | | access_control_auditor.py | Access control, MFA, SSO, PAM, RBAC audit | JSON config describing access controls |
Audit Domains
1. Cloud Infrastructure Security
AWS Security Audit Checklist
IAM Policies and Roles
| Check ID | Control | Severity | Frameworks | |----------|---------|----------|------------| | AWS-IAM-001 | Root account has MFA enabled (hardware MFA preferred) | Critical | SOC 2 CC6.1, ISO 27001 A.9.2.1, PCI-DSS 8.3, NIST CSF PR.AC-1, HIPAA 164.312(d), FedRAMP AC-2 | | AWS-IAM-002 | Root account has no access keys | Critical | SOC 2 CC6.1, ISO 27001 A.9.2.3, PCI-DSS 2.1, NIST CSF PR.AC-4 | | AWS-IAM-003 | No IAM policies with "Effect": "Allow", "Action": "", "Resource": "" | Critical | SOC 2 CC6.3, ISO 27001 A.9.4.1, PCI-DSS 7.1, NIST CSF PR.AC-4 | | AWS-IAM-004 | All IAM users have MFA enabled | High | SOC 2 CC6.1, ISO 27001 A.9.4.2, PCI-DSS 8.3, HIPAA 164.312(d) | | AWS-IAM-005 | IAM password policy enforces minimum 14 characters | Medium | SOC 2 CC6.1, ISO 27001 A.9.4.3, PCI-DSS 8.2.3, NIST CSF PR.AC-1 | | AWS-IAM-006 | IAM roles use external ID for cross-account access | Medium | SOC 2 CC6.3, ISO 27001 A.9.2.1 | | AWS-IAM-007 | Unused IAM credentials (>90 days) are disabled | Medium | SOC 2 CC6.2, ISO 27001 A.9.2.6, PCI-DSS 8.1.4 | | AWS-IAM-008 | IAM Access Analyzer is enabled in all regions | Medium | SOC 2 CC6.1, ISO 27001 A.9.2.5 | | AWS-IAM-009 | No inline IAM policies (use managed policies) | Low | ISO 27001 A.9.2.2 | | AWS-IAM-010 | IAM policy conditions restrict by source IP or VPC where possible | Low | SOC 2 CC6.6, NIST CSF PR.AC-3 |
S3 Bucket Security
| Check ID | Control | Severity | Frameworks | |----------|---------|----------|------------| | AWS-S3-001 | S3 Block Public Access enabled at account level | Critical | SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3, HIPAA 164.312(e)(1), GDPR Art.32 | | AWS-S3-002 | No S3 buckets with public ACLs or policies | Critical | SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3, HIPAA 164.312(e)(1) | | AWS-S3-003 | Server-side encryption enabled (SSE-S3 minimum, SSE-KMS preferred) | High | SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 3.4, HIPAA 164.312(a)(2)(iv), GDPR Art.32 | | AWS-S3-004 | Versioning enabled on critical data buckets | Medium | SOC 2 CC6.7, ISO 27001 A.12.3.1 | | AWS-S3-005 | Access logging enabled for all buckets | Medium | SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.2 | | AWS-S3-006 | Lifecycle policies configured for log retention | Low | SOC 2 CC7.2, ISO 27001 A.12.4.1 | | AWS-S3-007 | MFA Delete enabled for critical buckets | Medium | SOC 2 CC6.7, ISO 27001 A.12.3.1 | | AWS-S3-008 | S3 Object Lock enabled for compliance data (WORM) | Medium | SEC Rule 17a-4, HIPAA 164.312(c)(1) |
VPC Configuration
| Check ID | Control | Severity | Frameworks | |----------|---------|----------|------------| | AWS-VPC-001 | VPC Flow Logs enabled for all VPCs | High | SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.2, NIST CSF DE.CM-1 | | AWS-VPC-002 | Default security group restricts all inbound/outbound | High | SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.2 | | AWS-VPC-003 | No security groups allow 0.0.0.0/0 on SSH (22) or RDP (3389) | Critical | SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3, NIST CSF PR.AC-5 | | AWS-VPC-004 | Private subnets used for databases and application tiers | High | SOC 2 CC6.6, ISO 27001 A.13.1.3, PCI-DSS 1.3 | | AWS-VPC-005 | NACLs configured as additional defense layer | Medium | SOC 2 CC6.6, PCI-DSS 1.2 | | AWS-VPC-006 | VPC endpoints used for AWS service access (avoid public internet) | Medium | SOC 2 CC6.6, ISO 27001 A.13.1.1 | | AWS-VPC-007 | Transit Gateway or VPC Peering uses non-overlapping CIDRs | Low | ISO 27001 A.13.1.1 |
RDS Security
| Check ID | Control | Severity | Frameworks | |----------|---------|----------|------------| | AWS-RDS-001 | Encryption at rest enabled (KMS) | High | SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 3.4, HIPAA 164.312(a)(2)(iv) | | AWS-RDS-002 | SSL/TLS connections enforced (rds.force_ssl = 1) | High | SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 4.1 | | AWS-RDS-003 | Automated backups enabled with minimum 7-day retention | Medium | SOC 2 CC6.7, ISO 27001 A.12.3.1, HIPAA 164.308(a)(7)(ii)(A) | | AWS-RDS-004 | Multi-AZ deployment for production databases | Medium | SOC 2 A1.2, ISO 27001 A.17.1.1 | | AWS-RDS-005 | Database instances not publicly accessible | Critical | SOC 2 CC6.6, PCI-DSS 1.3 | | AWS-RDS-006 | Enhanced monitoring enabled | Low | SOC 2 CC7.2, ISO 27001 A.12.4.1 | | AWS-RDS-007 | Deletion protection enabled for production instances | Medium | SOC 2 CC6.7 |
CloudTrail and Monitoring
| Check ID | Control | Severity | Frameworks | |----------|---------|----------|------------| | AWS-CT-001 | CloudTrail enabled in all regions | Critical | SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.1, HIPAA 164.312(b), NIST CSF DE.CM-1, FedRAMP AU-2 | | AWS-CT-002 | CloudTrail log file validation enabled | High | SOC 2 CC7.2, ISO 27001 A.12.4.3, PCI-DSS 10.5 | | AWS-CT-003 | CloudTrail logs delivered to S3 with encryption | High | SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.5 | | AWS-CT-004 | CloudTrail integrated with CloudWatch Logs | Medium | SOC 2 CC7.2, ISO 27001 A.12.4.1 | | AWS-CT-005 | G