What this prompt does
This prompt runs a cloud security posture assessment against the CIS Benchmarks for your environment. You provide the [cloud_provider], [account_structure], [workloads], [compliance_frameworks], and [existing_tools], and it assesses six domains — IAM, network security, data protection, logging/monitoring, compute/container security, and remediation — then maps findings to compliance and generates Infrastructure-as-Code fixes in your [iac_tool].
The structure works because cloud breaches usually come from a handful of quiet misconfigurations: 0.0.0.0/0 security-group rules, over-permissioned IAM roles, unencrypted storage, and missing audit logs. The prompt sweeps exactly these against CIS Benchmark controls, then — crucially — generates [iac_tool] remediation code alongside each finding so fixes are reviewable in a pull request rather than clicked through a console. The [compliance_frameworks] mapping turns raw findings into audit evidence.
When to use it
- You're securing a
[cloud_provider]account and want a structured CIS Benchmark sweep instead of ad-hoc checks. - You suspect over-permissioned roles or open
0.0.0.0/0rules and need them found and prioritized. - An audit for
[compliance_frameworks]like SOC 2 or GDPR requires documented posture evidence. - You want remediation as reviewable
[iac_tool](Terraform) code, not manual console changes. - You're managing a multi-account
[account_structure]and need cross-account trust and logging reviewed. - You need findings risk-ranked with concrete fix deadlines (24h / 7d / 30d / 90d).
Example output
You get a structured report across six domains: IAM (root security, over-permissioned roles, least-privilege policy code), network (open security groups, VPC flow logs, public-resource inventory), data protection (encryption at rest/transit, KMS rotation), logging (CloudTrail coverage, alert rules), and compute/container security (patching, image scanning, IMDSv2). Each finding comes with a severity, affected resources, and an [iac_tool] remediation block, plus a compliance mapping to your [compliance_frameworks] and a prioritized fix timeline.
Pro tips
- Specify
[cloud_provider]exactly (AWS, GCP, Azure); the CIS controls and resource names differ across them. - Describe
[account_structure]in detail so cross-account trust and centralized logging get assessed properly. - List your
[existing_tools](Security Hub, GuardDuty) so the prompt complements them instead of duplicating coverage. - Name your real
[compliance_frameworks]to get findings mapped to actual control requirements and evidence artifacts. - Treat the
[iac_tool]remediation as a starting point — review every generated change before applying it to production. - Run the IAM and network domains first; that's where the highest-impact exposures typically hide.
