infrastructure-compliance-auditor

What this skill does

# Infrastructure Compliance Auditor

Cross-cutting infrastructure security audit across ALL compliance frameworks. Replaces manual Vanta-style checks with deterministic, repeatable, evidence-generating infrastructure audits covering cloud, DNS, TLS, endpoints, access control, network, containers, CI/CD, secrets, logging, and physical security.

---

## Table of Contents

- [Trigger Phrases](#trigger-phrases)
- [Quick Start](#quick-start)
- [Tools](#tools)
- [Audit Domains](#audit-domains)
  - [1. Cloud Infrastructure Security](#1-cloud-infrastructure-security)
  - [2. DNS Security](#2-dns-security)
  - [3. TLS/SSL Security](#3-tlsssl-security)
  - [4. Endpoint Security](#4-endpoint-security)
  - [5. Access Control and Authentication](#5-access-control-and-authentication)
  - [6. Network Security](#6-network-security)
  - [7. Container and Kubernetes Security](#7-container-and-kubernetes-security)
  - [8. CI/CD Pipeline Security](#8-cicd-pipeline-security)
  - [9. Secrets Management](#9-secrets-management)
  - [10. Logging and Monitoring](#10-logging-and-monitoring)
  - [11. Physical Security](#11-physical-security)
  - [12. Compliance Framework Mapping](#12-compliance-framework-mapping)
- [Workflows](#workflows)
- [Reference Guides](#reference-guides)
- [Validation Checkpoints](#validation-checkpoints)
- [Scoring Methodology](#scoring-methodology)

---

## Trigger Phrases

Use this skill when you hear:
- "infrastructure audit"
- "cloud security audit"
- "infrastructure compliance"
- "DNS security audit"
- "TLS audit"
- "endpoint security"
- "access control audit"
- "network security assessment"
- "infrastructure security"
- "cloud compliance"
- "Vanta alternative"
- "compliance automation"
- "security posture assessment"
- "hardware security keys"
- "YubiKey compliance"

---

## Quick Start

### Run Full Infrastructure Audit

```bash
python scripts/infra_audit_runner.py --config infrastructure.json --output audit_report.json
```

### Audit DNS Security for a Domain

```bash
python scripts/dns_security_checker.py --domain example.com --output dns_report.json
```

### Audit Access Controls

```bash
python scripts/access_control_auditor.py --config access_controls.json --output access_report.json
```

### Generate Compliance-Mapped Report

```bash
python scripts/infra_audit_runner.py --config infrastructure.json --frameworks soc2,iso27001,hipaa --format markdown --output compliance_report.md
```

---

## Tools

| Tool | Purpose | Input |
|------|---------|-------|
| `infra_audit_runner.py` | Full infrastructure audit across all 11 domains | JSON config describing infrastructure |
| `dns_security_checker.py` | DNS-specific security audit (SPF, DKIM, DMARC, DNSSEC, CAA, MTA-STS) | Domain name |
| `access_control_auditor.py` | Access control, MFA, SSO, PAM, RBAC audit | JSON config describing access controls |

---

## Audit Domains

### 1. Cloud Infrastructure Security

#### AWS Security Audit Checklist

**IAM Policies and Roles**

| Check ID | Control | Severity | Frameworks |
|----------|---------|----------|------------|
| AWS-IAM-001 | Root account has MFA enabled (hardware MFA preferred) | Critical | SOC 2 CC6.1, ISO 27001 A.9.2.1, PCI-DSS 8.3, NIST CSF PR.AC-1, HIPAA 164.312(d), FedRAMP AC-2 |
| AWS-IAM-002 | Root account has no access keys | Critical | SOC 2 CC6.1, ISO 27001 A.9.2.3, PCI-DSS 2.1, NIST CSF PR.AC-4 |
| AWS-IAM-003 | No IAM policies with `"Effect": "Allow", "Action": "*", "Resource": "*"` | Critical | SOC 2 CC6.3, ISO 27001 A.9.4.1, PCI-DSS 7.1, NIST CSF PR.AC-4 |
| AWS-IAM-004 | All IAM users have MFA enabled | High | SOC 2 CC6.1, ISO 27001 A.9.4.2, PCI-DSS 8.3, HIPAA 164.312(d) |
| AWS-IAM-005 | IAM password policy enforces minimum 14 characters | Medium | SOC 2 CC6.1, ISO 27001 A.9.4.3, PCI-DSS 8.2.3, NIST CSF PR.AC-1 |
| AWS-IAM-006 | IAM roles use external ID for cross-account access | Medium | SOC 2 CC6.3, ISO 27001 A.9.2.1 |
| AWS-IAM-007 | Unused IAM credentials (>90 days) are disabled | Medium | SOC 2 CC6.2, ISO 27001 A.9.2.6, PCI-DSS 8.1.4 |
| AWS-IAM-008 | IAM Access Analyzer is enabled in all regions | Medium | SOC 2 CC6.1, ISO 27001 A.9.2.5 |
| AWS-IAM-009 | No inline IAM policies (use managed policies) | Low | ISO 27001 A.9.2.2 |
| AWS-IAM-010 | IAM policy conditions restrict by source IP or VPC where possible | Low | SOC 2 CC6.6, NIST CSF PR.AC-3 |

**S3 Bucket Security**

| Check ID | Control | Severity | Frameworks |
|----------|---------|----------|------------|
| AWS-S3-001 | S3 Block Public Access enabled at account level | Critical | SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3, HIPAA 164.312(e)(1), GDPR Art.32 |
| AWS-S3-002 | No S3 buckets with public ACLs or policies | Critical | SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3, HIPAA 164.312(e)(1) |
| AWS-S3-003 | Server-side encryption enabled (SSE-S3 minimum, SSE-KMS preferred) | High | SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 3.4, HIPAA 164.312(a)(2)(iv), GDPR Art.32 |
| AWS-S3-004 | Versioning enabled on critical data buckets | Medium | SOC 2 CC6.7, ISO 27001 A.12.3.1 |
| AWS-S3-005 | Access logging enabled for all buckets | Medium | SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.2 |
| AWS-S3-006 | Lifecycle policies configured for log retention | Low | SOC 2 CC7.2, ISO 27001 A.12.4.1 |
| AWS-S3-007 | MFA Delete enabled for critical buckets | Medium | SOC 2 CC6.7, ISO 27001 A.12.3.1 |
| AWS-S3-008 | S3 Object Lock enabled for compliance data (WORM) | Medium | SEC Rule 17a-4, HIPAA 164.312(c)(1) |

**VPC Configuration**

| Check ID | Control | Severity | Frameworks |
|----------|---------|----------|------------|
| AWS-VPC-001 | VPC Flow Logs enabled for all VPCs | High | SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.2, NIST CSF DE.CM-1 |
| AWS-VPC-002 | Default security group restricts all inbound/outbound | High | SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.2 |
| AWS-VPC-003 | No security groups allow 0.0.0.0/0 on SSH (22) or RDP (3389) | Critical | SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3, NIST CSF PR.AC-5 |
| AWS-VPC-004 | Private subnets used for databases and application tiers | High | SOC 2 CC6.6, ISO 27001 A.13.1.3, PCI-DSS 1.3 |
| AWS-VPC-005 | NACLs configured as additional defense layer | Medium | SOC 2 CC6.6, PCI-DSS 1.2 |
| AWS-VPC-006 | VPC endpoints used for AWS service access (avoid public internet) | Medium | SOC 2 CC6.6, ISO 27001 A.13.1.1 |
| AWS-VPC-007 | Transit Gateway or VPC Peering uses non-overlapping CIDRs | Low | ISO 27001 A.13.1.1 |

**RDS Security**

| Check ID | Control | Severity | Frameworks |
|----------|---------|----------|------------|
| AWS-RDS-001 | Encryption at rest enabled (KMS) | High | SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 3.4, HIPAA 164.312(a)(2)(iv) |
| AWS-RDS-002 | SSL/TLS connections enforced (`rds.force_ssl = 1`) | High | SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 4.1 |
| AWS-RDS-003 | Automated backups enabled with minimum 7-day retention | Medium | SOC 2 CC6.7, ISO 27001 A.12.3.1, HIPAA 164.308(a)(7)(ii)(A) |
| AWS-RDS-004 | Multi-AZ deployment for production databases | Medium | SOC 2 A1.2, ISO 27001 A.17.1.1 |
| AWS-RDS-005 | Database instances not publicly accessible | Critical | SOC 2 CC6.6, PCI-DSS 1.3 |
| AWS-RDS-006 | Enhanced monitoring enabled | Low | SOC 2 CC7.2, ISO 27001 A.12.4.1 |
| AWS-RDS-007 | Deletion protection enabled for production instances | Medium | SOC 2 CC6.7 |

**CloudTrail and Monitoring**

| Check ID | Control | Severity | Frameworks |
|----------|---------|----------|------------|
| AWS-CT-001 | CloudTrail enabled in all regions | Critical | SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.1, HIPAA 164.312(b), NIST CSF DE.CM-1, FedRAMP AU-2 |
| AWS-CT-002 | CloudTrail log file validation enabled | High | SOC 2 CC7.2, ISO 27001 A.12.4.3, PCI-DSS 10.5 |
| AWS-CT-003 | CloudTrail logs delivered to S3 with encryption | High | SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.5 |
| AWS-CT-004 | CloudTrail integrated with CloudWatch Logs | Medium | SOC 2 CC7.2, ISO 27001 A.12.4.1 |
| AWS-CT-005 | G