AWS Security Analysis

1---
2name: aws-security-analysis
3description: Analyze AWS infrastructure security using Cyntrisec MCP tools. Use when asked about AWS attack paths, security findings, IAM permissions, compliance status, or remediation recommendations. Guides tool selection and workflow patterns for comprehensive security assessments.
4license: Apache-2.0
5metadata:
6  author: cyntrisec
7  version: "0.1.7"
8---
9 
10# AWS Security Analysis
11 
12This skill guides you through analyzing AWS infrastructure security using Cyntrisec MCP tools.
13 
14## Prerequisites
15 
16Before using any tool, ensure a scan exists:
17- Call `get_scan_summary` first to verify scan data is available
18- If you receive `SNAPSHOT_NOT_FOUND`, inform the user to run `cyntrisec scan` first
19 
20## Tool Selection Guide
21 
22### When User Asks About...
23 
24| User Question | Tool to Use |
25|--------------|-------------|
26| "What's in my AWS account?" | `get_scan_summary` → `get_assets` |
27| "What are the security issues?" | `get_findings` (filter by severity if specified) |
28| "Show me attack paths" | `get_attack_paths` |
29| "Explain this attack path" | `explain_path` (requires path_id) |
30| "How do I fix this?" | `get_remediations` → `get_terraform_snippet` |
31| "Can role X access resource Y?" | `check_access` |
32| "What permissions are unused?" | `get_unused_permissions` |
33| "Are we compliant?" | `check_compliance` |
34| "What changed since last scan?" | `compare_scans` |
35 
36### Tool Categories
37 
38**Discovery (start here)**
39- `get_scan_summary` - Always call first to understand scope
40- `list_tools` - Show available capabilities
41 
42**Data Retrieval**
43- `get_assets` - Browse AWS resources (EC2, IAM, S3, RDS, Lambda)
44- `get_relationships` - See how assets connect (CAN_ASSUME, CAN_REACH, MAY_ACCESS)
45- `get_findings` - Security issues found in the scan
46 
47**Attack Analysis**
48- `get_attack_paths` - Paths from internet to sensitive targets
49- `explain_path` - Step-by-step breakdown of an attack path
50- `explain_finding` - Deep dive into a specific finding
51 
52**Remediation**
53- `get_remediations` - Optimal fixes using min-cut algorithm
54- `get_terraform_snippet` - IaC code to implement a fix
55 
56**Advanced**
57- `check_access` - Simulate IAM access decisions
58- `get_unused_permissions` - Find permission bloat
59- `check_compliance` - CIS AWS or SOC 2 frameworks
60 
61## Common Workflows
62 
63### Workflow 1: Security Assessment
64 
65User wants to understand their security posture.
66 
67```
681. get_scan_summary
69   → Understand scope: account, regions, asset counts
70 
712. get_findings(severity="CRITICAL")
72   → Focus on highest priority issues first
73 
743. get_attack_paths(min_risk=0.7)
75   → Find high-risk paths to sensitive targets
76 
774. explain_path(path_id=<from step 3>)
78   → Understand the most critical path in detail
79```
80 
81### Workflow 2: Remediation Planning
82 
83User wants to fix security issues efficiently.
84 
85```
861. get_attack_paths
87   → See all attack paths
88 
892. get_remediations(max_cuts=5)
90   → Find minimal set of changes to block most paths
91 
923. For each remediation:
93   get_terraform_snippet(source, target, relationship_type)
94   → Generate IaC code
95```
96 
97### Workflow 3: Compliance Audit
98 
99User needs compliance status for audit.
100 
101```
1021. check_compliance(framework="cis-aws")  # or "soc2"
103   → Get compliance score and failing controls
104 
1052. get_findings(severity="HIGH")
106   → Correlate findings with compliance gaps
107 
1083. get_remediations
109   → Prioritize fixes by compliance impact
110```
111 
112### Workflow 4: Access Investigation
113 
114User asks "Can X access Y?" or investigates lateral movement.
115 
116```
1171. check_access(principal="RoleName", resource="s3://bucket-name")
118   → Direct answer: yes/no with relationship type
119 
1202. If access exists, use:
121   get_relationships(source_name="RoleName")
122   → Understand the full access chain
123```
124 
125### Workflow 5: Permission Optimization
126 
127User wants to reduce blast radius or clean up IAM.
128 
129```
1301. get_unused_permissions(days_threshold=90)
131   → Find stale permissions
132 
1332. get_assets(asset_type="iam:role")
134   → List all roles for context
135 
1363. Present reduction opportunities by blast_radius_reduction score
137```
138 
139### Workflow 6: Drift Detection
140 
141User wants to know what changed.
142 
143```
1441. compare_scans
145   → Shows new/removed assets, relationships, paths, findings
146 
1472. If regressions detected:
148   get_attack_paths
149   → Focus on new attack paths
150```
151 
152## Best Practices
153 
154### Always Do
155 
156- **Start with `get_scan_summary`** - Establishes context and verifies data exists
157- **Use severity filters** - Focus on CRITICAL/HIGH first: `get_findings(severity="CRITICAL")`
158- **Use min_risk filter** - Focus on high-risk paths: `get_attack_paths(min_risk=0.7)`
159- **Chain explain tools** - After listing, offer to explain specific items
160- **Present ROI scores** - When showing remediations, highlight `roi_score` for prioritization
161 
162### Never Do
163 
164- **Skip the summary** - Always verify scan data exists first
165- **Return raw IDs without context** - Always include names and descriptions
166- **Overwhelm with data** - Use `max_*` parameters to limit results
167- **Ignore error codes** - Handle `SNAPSHOT_NOT_FOUND` and `INSUFFICIENT_DATA` gracefully
168 
169### Response Patterns
170 
171When showing attack paths:
172```
173Found {total} attack paths. Top {n} by risk:
174 
1751. **{source_name} → {target_name}** (Risk: {risk_score})
176   Vector: {attack_vector}
177   Path: {path_assets joined by " → "}
178```
179 
180When showing remediations:
181```
182Top remediation opportunities:
183 
1841. **Block {source} → {target}** ({relationship_type})
185   - Blocks {paths_blocked} attack paths
186   - Estimated savings: ${estimated_savings}
187   - ROI Score: {roi_score}
188```
189 
190## Troubleshooting
191 
192### No scan data found
193```
194Error: SNAPSHOT_NOT_FOUND
195```
196→ User needs to run `cyntrisec scan` with AWS credentials configured.
197 
198### Need multiple scans for comparison
199```
200Error: INSUFFICIENT_DATA
201```
202→ User needs at least 2 scans to use `compare_scans`.
203 
204### No attack paths found
205This is good news! The infrastructure has no detected paths from internet-facing resources to sensitive targets.
206 
207### Empty findings
208Either the infrastructure is well-configured, or the scan may need to cover more services/regions.
209 
210## Tool Parameter Reference
211 
212### Severity Values
213`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`
214 
215### Asset Types
216`iam:role`, `iam:user`, `iam:policy`, `ec2:instance`, `ec2:security-group`, `s3:bucket`, `rds:instance`, `lambda:function`
217 
218### Relationship Types
219`CAN_ASSUME`, `CAN_REACH`, `MAY_ACCESS`, `ALLOWS_TRAFFIC_TO`, `HAS_POLICY`, `MEMBER_OF`
220 
221### Compliance Frameworks
222`cis-aws`, `soc2`
223