Claude/ChatGPT Prompt to Run an AWS Security Best-Practices Audit

What this prompt does

This prompt runs the AI through a structured AWS security audit across an estate of [account_count] accounts. It moves in sequence through IAM, network security, encryption, logging, compliance, detective controls, and secrets management, then closes with a prioritized remediation plan. You point it at your [iam_concerns], [network_issues], and [encryption_scope], and it surfaces the usual exposure points — root account usage, missing MFA, stale access keys, overly permissive policies, and public resources that should be private.

The structure works because walking each domain in order keeps an audit from collapsing into an unactionable wall of findings. It generates least-privilege policy replacements for [critical_roles], checks against your [compliance_framework] with a gap analysis, and recommends GuardDuty, Security Hub, and Config rules for [config_rules]. The closing remediation plan ranks issues with effort estimates, which is what makes the output something a team can actually work through rather than file and forget.

When to use it

• You inherited an AWS account and need to know where the real exposure is before anything else
• You suspect IAM sprawl — developers with AdministratorAccess or service roles that are over-permissioned
• You need least-privilege policy replacements drafted for [critical_roles]
• You want a gap analysis against [compliance_framework] such as the CIS AWS Foundations Benchmark
• You need to confirm CloudTrail, VPC flow logs, and centralized logging to [log_destination] are in place
• You are scanning for hardcoded credentials across [code_locations] and Lambda environment variables

Example output

Expect a sectioned audit report: IAM findings with proposed least-privilege policies for your critical roles, a network review of security groups and NACLs, an encryption audit across data at rest and in transit, a logging-coverage check, a compliance gap analysis against your chosen framework, detective-control recommendations, and a closing remediation plan that ranks every finding by priority with effort estimates.

Pro tips

• Be candid in [iam_concerns] — admitting that several developers hold AdministratorAccess produces far more useful findings than a sanitized description
• Name your real [critical_roles] so the least-privilege replacements target the policies that actually matter, like CI/CD and Lambda execution roles
• Set [compliance_framework] to the exact version you are measured against; CIS v3.0 controls differ from earlier revisions
• The model cannot scan your live account, so it produces a checklist and policy drafts you must verify against actual IAM, Config, and CloudTrail state
• Treat generated least-privilege policies as starting points — test them in a non-production role before applying, since over-tightening can break deployments
• Work the remediation plan top-down by priority and effort rather than trying to fix everything at once; the ranking exists to sequence the work
• Confirm CloudTrail is enabled in every region, not just your active ones, since attackers often operate in regions you never use
• Re-run the audit after remediation so the gap analysis against [compliance_framework] reflects your hardened state, not the original findings