Building an AWS Pentest Skill for Claude Code
April 2026 - 7 min read
aws security claude pentest ai

AWS security assessments follow a pretty predictable pattern. You enumerate IAM, run ScoutSuite and Prowler, dig through the results, chase whatever privilege escalation paths look interesting. Same steps every time. So I built a Claude Code skill for it - type /aws-pentest, pass it a profile, and it just gets on with it. The skill is up on GitHub at github.com/adailycanof/claude-skills if you want to use it or poke around.

What is a Claude Code Skill?

Skills are custom slash commands that live in ~/.claude/skills/. At the core it's a SKILL.md file with some YAML frontmatter - name, description, which tools Claude is allowed to use, and an argument hint. Invoke it and Claude loads the file as its instructions and starts working.

The useful bit is that skills can reference other markdown files as context. So the main SKILL.md stays short and readable, and the actual detail lives in separate files - a methodology doc, a report template, whatever you need.

Skill Structure

Clone the repo and copy it into your Claude skills directory: 

git clone https://github.com/adailycanof/claude-skills.git
cp -r claude-skills ~/.claude/skills/aws-pentest/

The skill folder has four files:

  • SKILL.md - the entry point, engagement setup, phase order, rules of engagement
  • methodology.md - the actual commands and steps for each phase
  • tools.md - reference for what each tool does and when to use it
  • report-template.md - how findings get written up

The frontmatter looks like this:

---
name: aws-pentest
description: Conduct an authorised AWS penetration test against a single
             account or whole organisation.
argument-hint: [profile] [scope: account|org] [output-dir]
allowed-tools: Bash, Read, Write, Glob, Grep
---

The tool list isn't just defaults - Bash is there to run CLI commands and the security tooling, Read/Write to load the methodology and write the report, Glob/Grep to pick through output files.

The Methodology

Eight phases, run in order. Claude summarises what it found after each one before moving on.

  • Phase 1 - Recon: Who are we? What account? Is it part of an org? What regions are enabled?
  • Phase 2 - Enumeration: Full sweep - S3 ACLs and bucket policies, all IAM users/roles/groups/policies, EC2 and security groups, networking.
  • Phase 3 - Misconfiguration Auditing: ScoutSuite and Prowler do the heavy lifting here. Public S3, open ingress rules, CloudTrail gaps, MFA not enforced, access keys that haven't been rotated in months.
  • Phase 4 - IAM Analysis: PMapper and CloudFox map out the IAM graph and find privilege escalation paths. The classics: iam:CreatePolicyVersion, iam:PassRole + ec2:RunInstances, iam:CreateAccessKey.
  • Phase 5 - Secret Discovery: TruffleHog over S3 and git history, CloudFox pulling SSM/Secrets Manager/Lambda env vars, manual checks on EC2 user-data.
  • Phase 6 - Attack Path Exploitation: Pacu for testing confirmed privesc paths. Only runs with explicit authorisation - no data exfiltration, no touching resources.
  • Phase 7 - Web & API Testing: CloudFox finds the exposed endpoints, then gobuster, ffuf, and nuclei take a look at anything public-facing.
  • Phase 8 - Reporting: Everything compiled into a structured report with severity ratings, evidence, impact, and remediation steps. Full command log goes in the appendix.

Rules of Engagement

These are baked into the skill prompt so they're always there: 

- Only test resources within the agreed scope
- Do not exfiltrate real data - note access as a finding only
- Do not modify or delete resources unless explicitly authorised
- Stop and flag any critical findings immediately
  (e.g. exposed root credentials, public S3 with PII)
- Log every command run for the report appendix

The immediate-flag rule is the one that actually matters day to day. If TruffleHog finds root credentials sitting in a public bucket, Claude stops and tells you rather than quietly logging it and carrying on. That's the behaviour you want.

Running It

/aws-pentest [profile] [account|org] [output-dir]

All three arguments are optional. Some examples: 

/aws-pentest                          # default profile, account scope, ./pentest-output/
/aws-pentest dev-profile              # specific profile
/aws-pentest prod account /tmp/test   # explicit profile, scope, and output dir

From there it just runs. All eight phases, commands logged, report building as it goes. On a normal-sized account it gets through everything in 15-30 minutes depending on how gnarly the IAM graph is.

Why It Works

Pentest assessments are a good fit for this kind of automation because the methodology doesn't really change. The steps are the same every time, the tooling is scriptable, and the main thing that varies is what you find. Claude isn't doing anything clever - it's just being thorough in a way that's easy to skip when you're doing it manually for the fourth time this month.

The org-scope mode is where it saves the most time. Running Prowler and PMapper across every member account by hand is a slog. Having it handle the iteration and roll everything into one report is genuinely useful.

Prerequisites

You need the tooling installed before running it. The skill will carry on if something is missing and flag it, but you'll get gaps in the output. Here's what each phase needs: 

AWS CLI       brew install awscli
CloudFox      brew install cloudfox
Prowler       pip install prowler
TruffleHog    brew install trufflehog
Pacu          pip install pacu
ScoutSuite    pip install scoutsuite
PMapper       pip install principalmapper
gobuster      brew install gobuster
ffuf          brew install ffuf
nuclei        brew install nuclei

Limitations

  • Phase 6 trusts you've got authorisation. It checks, but ultimately you're responsible.
  • Big accounts with lots of regions generate a lot of output. Keep an eye on disk space.
  • The report is a solid first draft, not a finished deliverable. You'll still want to read it.

What's Next

I want to build Azure and GCP versions using the same structure, and a lightweight quick-audit variant that just runs Prowler and shows you the Critical/High findings without the full eight-phase treatment. Also thinking about auto-generating remediation tickets from the report output. For now though the AWS version does what I need it to.