checking-infrastructure-compliance
Automates compliance monitoring and infrastructure validation using policy-as-code tools like OPA and Checkov.
Install
mkdir -p .claude/skills/checking-infrastructure-compliance && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/8494" && unzip -o skill.zip -d .claude/skills/checking-infrastructure-compliance && rm skill.zipInstalls to .claude/skills/checking-infrastructure-compliance
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Execute use when you need to work with compliance checking.Key capabilities
- →Scan Terraform files for security misconfigurations
- →Validate Kubernetes manifests for network policies
- →Check IAM policies for least-privilege violations
- →Generate compliance reports for SOC 2 or HIPAA
- →Produce remediation patches for infrastructure violations
How it works
It audits infrastructure configurations against compliance frameworks using policy-as-code tools to identify violations and generate remediation plans.
Inputs & outputs
When to use checking-infrastructure-compliance
- →Scan Terraform files for security misconfigurations
- →Validate Kubernetes manifests for network policies
- →Check IAM policies for least-privilege violations
- →Generate compliance reports for SOC 2 or HIPAA
About this skill
Checking Infrastructure Compliance
Overview
Audit infrastructure configurations against compliance frameworks (CIS Benchmarks, SOC 2, HIPAA, PCI-DSS, GDPR) using policy-as-code tools like Open Policy Agent (OPA), Checkov, and tfsec. Generate compliance reports, identify violations, and produce remediation plans for Terraform, Kubernetes, and cloud provider configurations.
Prerequisites
- Policy-as-code tool installed:
checkov,tfsec,opa, orkube-bench - Infrastructure-as-code files (Terraform, CloudFormation, Kubernetes manifests) in the project
- Cloud provider CLI authenticated with read access to resources
- Compliance framework requirements documented (CIS, SOC 2, HIPAA, PCI-DSS)
jqfor parsing JSON policy outputs
Instructions
- Identify the applicable compliance framework(s) based on industry and data classification
- Scan Terraform files with
checkov -d .ortfsec .to detect misconfigurations - Scan Kubernetes manifests for security issues: missing resource limits, privileged containers, missing network policies
- Validate IAM policies for least-privilege violations using cloud-native tools (
aws iam access-analyzer) - Check encryption at rest and in transit: verify S3 bucket encryption, database TLS, and EBS volume encryption
- Audit logging configurations: confirm CloudTrail/Cloud Audit Logs are enabled and sent to immutable storage
- Generate a compliance report mapping each finding to the relevant control (e.g., CIS AWS 2.1.1)
- Produce remediation Terraform/YAML patches for each violation with severity ranking (Critical, High, Medium, Low)
- Set up CI/CD integration so compliance checks block merges on Critical/High violations
Output
- Compliance scan results in JSON/SARIF format for CI integration
- Markdown compliance report with control mappings and pass/fail status
- Remediation code patches (Terraform diffs, Kubernetes manifest updates)
- OPA/Rego policy files for custom organizational rules
- CI/CD pipeline step configuration for automated compliance gating
Error Handling
| Error | Cause | Solution |
|---|---|---|
checkov: no Terraform files found | Scanner run from wrong directory | Specify path explicitly with -d path/to/terraform/ |
tfsec: failed to parse HCL | Syntax error in Terraform files | Run terraform validate first to fix HCL syntax before compliance scan |
False positive on compliance check | Rule too broad for the specific use case | Add inline skip comments (#checkov:skip=CKV_AWS_18:Reason) or create a .checkov.yml skip list |
OPA policy evaluation error | Rego syntax error or missing input data | Test policies with opa eval -d policy.rego -i input.json and validate Rego syntax |
Scan timeout on large codebase | Too many files or complex module references | Use --compact mode, scan directories individually, or increase timeout limits |
Examples
- "Run a CIS Benchmark compliance check against all Terraform files and generate a report with remediation steps for Critical findings."
- "Create OPA policies that enforce: all S3 buckets must have encryption, all EC2 instances must have IMDSv2, and all security groups must not allow 0.0.0.0/0 ingress."
- "Scan Kubernetes manifests for PCI-DSS compliance: verify no privileged containers, all pods have resource limits, and network policies exist for every namespace."
Resources
- Checkov: https://www.checkov.io/
- tfsec: https://aquasecurity.github.io/tfsec/
- Open Policy Agent: https://www.openpolicyagent.org/docs/latest/
- CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks
- kube-bench (CIS for Kubernetes): https://github.com/aquasecurity/kube-bench
When not to use it
- →Large codebases without compact mode
- →Files with invalid HCL syntax
Prerequisites
Limitations
- →Scan timeout on large codebase
- →False positive on compliance check
How it compares
It automates the mapping of infrastructure findings to specific industry control frameworks rather than just reporting raw security vulnerabilities.
Compared to similar skills
checking-infrastructure-compliance side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| checking-infrastructure-compliance (this skill) | 0 | 27d | Review | Intermediate |
| secrets-management | 5 | 3mo | Review | Advanced |
| devops-iac-engineer | 2 | 7mo | Review | Advanced |
| deploying-applications | 0 | 8mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by jeremylongshore
View all by jeremylongshore →You might also like
secrets-management
wshobson
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
devops-iac-engineer
davila7
Implements infrastructure as code using Terraform, Kubernetes, and cloud platforms. Designs scalable architectures, CI/CD pipelines, and observability solutions. Provides security-first DevOps practices and site reliability engineering guidance.
deploying-applications
ancoleman
Deployment patterns from Kubernetes to serverless and edge functions. Use when deploying applications, setting up CI/CD, or managing infrastructure. Covers Kubernetes (Helm, ArgoCD), serverless (Vercel, Lambda), edge (Cloudflare Workers, Deno), IaC (Pulumi, OpenTofu, SST), and GitOps patterns.
aegisops-ai
Anhvu1107
ALWAYS use this when the request matches Aegisops AI: Autonomous DevSecOps & FinOps Guardrails.
mlops-engineer
sickn33
Build comprehensive ML pipelines, experiment tracking, and model registries with MLflow, Kubeflow, and modern MLOps tools. Implements automated training, deployment, and monitoring across cloud platforms. Use PROACTIVELY for ML infrastructure, experiment management, or pipeline automation.
aws-advisor
tech-leads-club
Expert AWS Cloud Advisor for architecture design, security review, and implementation guidance. Leverages AWS MCP tools for accurate, documentation-backed answers. Use when user asks about AWS architecture, security, service selection, migrations, troubleshooting, or learning AWS. Triggers on AWS, Lambda, S3, EC2, ECS, EKS, DynamoDB, RDS, CloudFormation, CDK, Terraform, Serverless, SAM, IAM, VPC, API Gateway, or any AWS service.