From 1e6caa4442c91b3419f950d5eb3b6925c04d6762 Mon Sep 17 00:00:00 2001 From: Harish Mandhadi Date: Tue, 14 Jul 2026 16:56:59 -0700 Subject: [PATCH 1/2] feat: add drift-detection custom agent and drift-detection-baseline Add production drift detection agent with baseline methodology. - New drift-detection-baseline under skills/ - New drift-detection custom agent under custom-agents/ - Updated llms.txt with new entry --- custom-agents/drift-detection/CHANGELOG.md | 12 ++ custom-agents/drift-detection/README.md | 78 ++++++++++++ .../drift-detection/SYSTEM_PROMPT.md | 45 +++++++ llms.txt | 1 + .../drift-detection-baseline/.skilleval.yaml | 3 + skills/drift-detection-baseline/CHANGELOG.md | 10 ++ skills/drift-detection-baseline/README.md | 91 +++++++++++++ skills/drift-detection-baseline/SKILL.md | 120 ++++++++++++++++++ .../evals/eval_queries.json | 27 ++++ .../drift-detection-baseline/evals/evals.json | 52 ++++++++ 10 files changed, 439 insertions(+) create mode 100644 custom-agents/drift-detection/CHANGELOG.md create mode 100644 custom-agents/drift-detection/README.md create mode 100644 custom-agents/drift-detection/SYSTEM_PROMPT.md create mode 100644 skills/drift-detection-baseline/.skilleval.yaml create mode 100644 skills/drift-detection-baseline/CHANGELOG.md create mode 100644 skills/drift-detection-baseline/README.md create mode 100644 skills/drift-detection-baseline/SKILL.md create mode 100644 skills/drift-detection-baseline/evals/eval_queries.json create mode 100644 skills/drift-detection-baseline/evals/evals.json diff --git a/custom-agents/drift-detection/CHANGELOG.md b/custom-agents/drift-detection/CHANGELOG.md new file mode 100644 index 0000000..4085158 --- /dev/null +++ b/custom-agents/drift-detection/CHANGELOG.md @@ -0,0 +1,12 @@ +# Changelog + +## 1.0.0 + +- Initial version +- System prompt with Goal/Approach/Constraints/Output structure +- Uses `drift-detection-baseline` skill for expected state definitions +- Requires `use_aws` tool for read-only resource inspection +- Covers security posture, compliance, and lifecycle drift categories +- Produces drift detection report artifact with findings table +- Creates recommendations in improvements backlog for each deviation +- Includes AWS Config rule coverage gap analysis diff --git a/custom-agents/drift-detection/README.md b/custom-agents/drift-detection/README.md new file mode 100644 index 0000000..fb85e2c --- /dev/null +++ b/custom-agents/drift-detection/README.md @@ -0,0 +1,78 @@ +# Drift Detection — Custom Agent + +## Purpose + +This custom agent performs production drift detection — comparing the current state of AWS resources against a defined baseline of expected standards. It identifies security posture drift (encryption, network isolation, public access), compliance drift (tagging, logging, backups), and lifecycle drift (deprecated runtimes, end-of-life engine versions). Findings are reported as a structured artifact and tracked as recommendations in the improvements backlog. + +Unlike a general best-practices review, this agent performs **true drift detection**: it loads a defined expected state, discovers what actually exists, and reports the delta. This makes it suitable for recurring scheduled runs where the goal is to catch configuration changes that deviate from your team's standards. + +## Key Capabilities + +- Compares current resource configurations against defined baseline policies +- Detects security posture drift: encryption, network isolation, public access, exposed secrets +- Detects compliance drift: missing tags, disabled logging, insufficient backups +- Detects lifecycle drift: deprecated Lambda runtimes, end-of-support RDS engines, outdated EKS versions +- Identifies AWS Config rule coverage gaps and suggests rules to codify enforcement +- Produces a persisted drift detection report artifact +- Creates or updates recommendations in the improvements backlog for each finding +- Deduplicates findings across runs to keep the backlog clean + +## Prerequisites + +- An AWS DevOps Agent space +- IAM permissions for read-only resource inspection (covered by `AIDevOpsAgentAccessPolicy`): + - S3, RDS, EC2, Lambda, EKS, DynamoDB, CloudTrail, AWS Config, Resource Groups Tagging API +- The [drift-detection-baseline skill](../../skills/drift-detection-baseline/) uploaded to your Agent Space. Important note: for the skill to be used by the custom agent, choose "All agents" in the "Agent Type" field when importing the skill, even though the skill's README instructs to choose specific agent types + +## Creating the Agent + +1. In the DevOps Agent web app, go to the "Agents" menu (on the bottom left pane) +2. Click "Create agent" (on the right side), then on the new menu that popped up, click "Form" (the left-most option) +3. In the "Name" field, use "drift-detection" +4. Copy the content of the "SYSTEM_PROMPT.md" file from this directory, and paste it into the "System prompt" field in the custom agent creation form +5. In the "Skills" drop-down list, select the "drift-detection-baseline" skill, and click "Create agent" +6. Now we need to add the `use_aws` tool — in the new custom agent's window, click "Edit" +7. In the new popped up window, select "Chat". A new chat will start on the left side. Wait for DevOps Agent to finish thinking, and it'll ask you what would you like to change +8. Type "Add the use_aws tool to this custom agent". Once the chat is finished, verify in the custom agent's page that `use_aws` is shown under "Tools" for this custom agent + +## Executing the Agent + +### First Run (Recommended: On-Demand) + +For the first run, execute the agent on-demand to review findings, tune the baseline, and confirm recommendations are routed correctly: + +1. Navigate to the custom agent's page and click "Run" +2. Optionally provide a custom prompt to scope the review (see examples below) +3. Review the drift detection report artifact and recommendations + +### Scheduled Execution (After Tuning) + +After confirming the output is useful and low-noise, configure the agent to run on a schedule: + +- **Daily** — before business hours, for production accounts with active deployments +- **Weekly** — before operational reviews, for stable environments + +Follow the [Executing custom agents guide](https://docs.aws.amazon.com/devopsagent/latest/userguide/custom-agents-executing-custom-agents.html) for schedule configuration. + +### Custom Prompts + +You can scope the review with custom prompts: + +- "Focus only on S3 buckets and RDS instances" +- "Check only resources tagged with Environment: production" +- "Only report critical and high severity findings" +- "Focus on the us-east-1 region only" +- "Check for lifecycle drift only — deprecated runtimes and engines" + +## Output + +The agent produces: + +- **Drift Detection Report** — a Markdown artifact summarizing all resources scanned, deviations found, and Config rule coverage gaps +- **Recommendations** — individual improvement items in the backlog for each drift finding, with severity, resource ARN, current vs. expected state, and remediation steps + +## Related + +- [drift-detection-baseline skill](../../skills/drift-detection-baseline/) — the baseline policies this agent evaluates against +- [Blog post: Build bespoke operational workflows with AWS DevOps Agent custom SRE agents](https://aws.amazon.com/blogs/devops/build-bespoke-operational-workflows-with-aws-devops-agent-custom-sre-agents/) +- [AWS DevOps Agent custom agents documentation](https://docs.aws.amazon.com/devopsagent/latest/userguide/working-with-devops-agent-custom-agents-index.html) diff --git a/custom-agents/drift-detection/SYSTEM_PROMPT.md b/custom-agents/drift-detection/SYSTEM_PROMPT.md new file mode 100644 index 0000000..663df25 --- /dev/null +++ b/custom-agents/drift-detection/SYSTEM_PROMPT.md @@ -0,0 +1,45 @@ +You are a drift detection agent specializing in identifying deviations between current production infrastructure state and defined operational standards. + +## Goal + +Review provisioned AWS resources in the production environment for drift from defined standards and best practices. Create recommendations for any deviations found, and identify opportunities to codify standards as AWS Config rules for automated enforcement. + +## Approach + +1. Load the `drift-detection-baseline` skill to understand the expected production state for security posture, compliance, and lifecycle standards. +2. Load the `understanding-agent-space` skill to understand what resources exist in the production environment. +3. Identify resources that should be checked against the baseline policies (e.g., S3 buckets, RDS instances, Lambda functions, EC2 instances, security groups, DynamoDB tables). +4. Use `use_aws` to make read-only API calls and inspect the actual configuration state of each relevant resource, using the specific verification methods defined in the baseline skill. +5. Compare each resource's current configuration against the defined expected state in the baseline. +6. For each deviation found, classify severity using the baseline skill's severity framework and create a recommendation in the improvements backlog. +7. Use `use_aws` to list existing AWS Config rules and their configurations. +8. Compare the defined policies from `drift-detection-baseline` against existing Config rules to identify coverage gaps — standards that could be enforced via AWS Config but are not currently. + +## Constraints + +- Read-only access to infrastructure — do not make changes directly. +- Only flag deviations that clearly violate the defined baseline policies. +- Focus on provisioned resources, not code or deployment pipelines. +- Use the severity classification from the baseline skill consistently. +- If a resource cannot be found or accessed, report the access issue clearly rather than skipping silently. + +## Output + +Produce a single artifact titled "Drift Detection Report — [date]" containing: + +- A summary of resources scanned, organized by resource type, and total deviations found +- A table listing each drift item: resource ARN, policy violated, current state vs. expected state, severity, and suggested remediation +- A section titled "Config Rule Coverage Gaps" with: + - Policies from the baseline that could be codified as AWS Config rules but are not currently deployed + - For each gap: the policy, why it is a good fit for Config, and a suggested rule approach (managed rule if available, or custom rule outline) + +If a drift detection report artifact already exists, update it with the latest findings instead of creating a new one. + +Additionally, for each drift item found, create a recommendation with: +- A clear title describing the deviation +- The specific policy being violated (reference the baseline section) +- The resource ARN and current configuration state vs. expected state +- Severity level +- Suggested remediation steps + +Before creating a new recommendation, list existing recommendations and update an existing one if the same drift is already tracked. diff --git a/llms.txt b/llms.txt index f106887..3e7446d 100644 --- a/llms.txt +++ b/llms.txt @@ -22,6 +22,7 @@ Skills can be used with these AWS DevOps Agent types: - [Enrich with AWS Security Agent Skill](skills/enrich-with-aws-security-agent/SKILL.md): Queries AWS Security Agent CloudWatch logs to retrieve code-level security findings (file, line number, vulnerability type) during incident investigations with potential security root causes - [Wiz Security Context Skill](skills/wiz-security-context/SKILL.md): Queries the Wiz MCP server for a resource's security context (vulnerabilities, misconfigurations, secrets, active threats, malware, toxic combinations) to determine whether an operational anomaly is an operational issue or a security incident - [Service Quota Check Skill](skills/service-quota-check/SKILL.md): Checks AWS service quota utilization during investigations and before provisioning resources, flags quotas at 85%+ utilization, and requests increases via the Service Quotas API or recommends support cases +- [Drift Detection Baseline Skill](skills/drift-detection-baseline/SKILL.md): Defines expected production infrastructure state for drift detection workflows, covering security posture (encryption, network isolation, public access), compliance (tagging, logging, backups), and lifecycle standards (deprecated runtimes, EOL engines), with severity classification and AWS Config rule coverage gap analysis ## Key Concepts diff --git a/skills/drift-detection-baseline/.skilleval.yaml b/skills/drift-detection-baseline/.skilleval.yaml new file mode 100644 index 0000000..686a9c7 --- /dev/null +++ b/skills/drift-detection-baseline/.skilleval.yaml @@ -0,0 +1,3 @@ +audit: + ignore: + - STR-016 # README alongside SKILL.md is intentional diff --git a/skills/drift-detection-baseline/CHANGELOG.md b/skills/drift-detection-baseline/CHANGELOG.md new file mode 100644 index 0000000..fd195ab --- /dev/null +++ b/skills/drift-detection-baseline/CHANGELOG.md @@ -0,0 +1,10 @@ +# Changelog + +## 1.0.0 + +- Initial version +- Security posture baseline: encryption at rest/transit, network isolation, public access, secrets exposure +- Compliance baseline: resource tagging, CloudTrail, AWS Config, backup configuration +- Lifecycle baseline: Lambda runtimes, RDS engine versions, EKS cluster versions +- Severity classification framework (critical, high, medium, low) +- AWS Config rule coverage gap analysis methodology diff --git a/skills/drift-detection-baseline/README.md b/skills/drift-detection-baseline/README.md new file mode 100644 index 0000000..31392bd --- /dev/null +++ b/skills/drift-detection-baseline/README.md @@ -0,0 +1,91 @@ +# Drift Detection Baseline + +## Purpose + +This skill provides AWS DevOps Agent with a defined baseline of expected production infrastructure state for drift detection workflows. It enables the agent to compare current resource configurations against organizational standards and identify deviations (drift) across security posture, compliance, and lifecycle dimensions. + +Unlike a general best-practices audit, drift detection requires a **reference baseline** — a declared "expected state" to compare against. This skill serves as that baseline, providing the standards, verification methods, and severity framework the agent needs to systematically identify when production infrastructure has drifted from its intended configuration. + +## ⚠️ Important Notice + +This skill is provided as sample code. If you intend to deploy it in production, start with a non-production environment first, and before deploying to production: + +- Review and customize the baseline policies to match your organization's standards +- Test thoroughly in a non-production environment +- Validate that the severity classifications align with your operational priorities +- Extend with organization-specific policies as needed + +## Key Capabilities + +- Defines expected state for encryption, network isolation, public access, tagging, logging, and backups +- Provides specific AWS API calls and fields to verify each policy +- Classifies drift findings by severity (critical, high, medium, low) based on security exposure and blast radius +- Includes AWS Config rule coverage gap analysis to identify policies lacking automated enforcement +- Designed to be extended with organization-specific policies + +## Prerequisites + +- An AWS DevOps Agent space +- IAM permissions for read-only access to inspect resources: + - S3: `s3:GetEncryptionConfiguration`, `s3:GetBucketPublicAccessBlock`, `s3:GetBucketPolicy`, `s3:GetBucketTagging` + - RDS: `rds:DescribeDBInstances`, `rds:DescribeDBClusters`, `rds:ListTagsForResource` + - EC2: `ec2:DescribeVolumes`, `ec2:DescribeSecurityGroups`, `ec2:DescribeInstances` + - Lambda: `lambda:ListFunctions`, `lambda:GetFunctionConfiguration` + - EKS: `eks:DescribeCluster`, `eks:ListClusters` + - DynamoDB: `dynamodb:DescribeTable`, `dynamodb:DescribeContinuousBackups` + - Config: `config:DescribeConfigRules`, `config:DescribeConfigurationRecorders` + - CloudTrail: `cloudtrail:DescribeTrails`, `cloudtrail:GetTrailStatus` + - Resource Groups: `tag:GetResources` + +## Limitations + +- This skill defines a **sample baseline** — organizations should customize the policies, required tags, and severity thresholds to match their own standards +- Lifecycle drift detection (deprecated runtimes, EOL engine versions) requires knowledge of current AWS deprecation schedules, which change over time +- The skill covers foundational infrastructure policies but does not include application-level drift (latency thresholds, scaling policies, replication lag) +- AWS Config rule gap analysis relies on the agent's knowledge of available managed rules + +## Agent Types + +This skill is designed for use with: + +- **All agents** — select "All agents" when importing to enable use by custom agents and built-in agents alike +- Primarily consumed by the [drift-detection custom agent](../../custom-agents/drift-detection/) +- Also useful for Chat tasks when asking about infrastructure compliance + +## Uploading to AWS DevOps Agent + +1. From the `skills/` directory, create a zip of the skill: + ```bash + cd skills + zip -r drift-detection-baseline.zip drift-detection-baseline/ -i '*.md' '*.txt' '*.json' '*.yaml' '*.yml' -x '*/README.md' '*/.skilleval.yaml' '*/CHANGELOG.md' '*/evals/*' + ``` +2. In the DevOps Agent web app, navigate to **Skills** and click **Import skill** +3. Upload the zip file +4. Set **Agent Type** to "All agents" (required for custom agent usage) +5. Click **Import** + +## How to Use This Skill + +### With the Drift Detection Custom Agent (recommended) + +This skill is designed to be loaded by the [drift-detection custom agent](../../custom-agents/drift-detection/). See that agent's README for setup and execution instructions. + +### With Chat Tasks + +You can reference this skill directly in chat: + +- "Check my production resources for drift against the baseline policies" +- "Are there any S3 buckets that violate the encryption at rest policy?" +- "Which resources are missing required tags?" +- "Identify any resources running deprecated or end-of-life versions" +- "What AWS Config rules should I add to enforce the baseline policies?" + +### Extending the Baseline + +Create additional skills with your organization's specific policies: + +- Regulatory requirements (HIPAA, PCI-DSS, SOC2) +- Application-specific thresholds (latency, replication lag, cost limits) +- Team conventions (naming standards, environment separation rules) + +Load them alongside this baseline for comprehensive drift coverage. diff --git a/skills/drift-detection-baseline/SKILL.md b/skills/drift-detection-baseline/SKILL.md new file mode 100644 index 0000000..0870937 --- /dev/null +++ b/skills/drift-detection-baseline/SKILL.md @@ -0,0 +1,120 @@ +--- +name: drift-detection-baseline +description: Use this skill when performing drift detection on production infrastructure + to identify deviations from operational standards. Activate when you need to compare + current resource configurations against expected baseline state for security, compliance, + and lifecycle standards. This skill defines the expected state, verification methods, + and severity classification for infrastructure drift findings. +metadata: + author: hmandhad + version: "1.0.0" + aws-devops-agent-skills.agent-types: "Chat tasks, Prevention" + aws-devops-agent-skills.aws-services: "Amazon S3, Amazon RDS, AWS Lambda, Amazon EC2, Amazon EKS, Amazon DynamoDB, AWS Config, AWS CloudTrail" + aws-devops-agent-skills.technical-domains: "Operations, Security, Compliance" +--- + +# Drift Detection Baseline + +This skill defines the expected production baseline state and provides a systematic approach to detecting drift — deviations between current resource configuration and the defined expected state. + +## How to Use This Skill + +1. Load this skill to understand the expected baseline state for production resources. +2. Discover resources in the target environment using topology discovery or `Describe*`/`List*` API calls. +3. For each resource, extract the configuration fields listed in the verification columns below. +4. Compare actual state against expected state defined in this baseline. +5. Any mismatch between actual and expected state is a drift finding. +6. Classify each drift finding using the Severity Classification section. + +--- + +## Section 1: Security Posture Baseline (Mandatory — deviations are drift) + +These policies represent security standards that all production resources must meet. Any deviation is classified as drift and must be reported. + +| Policy | Expected State | Resources to Check | How to Verify | +|--------|---------------|-------------------|---------------| +| Encryption at rest | All data stores encrypted using AWS-managed or customer-managed KMS keys | S3 buckets, RDS instances, EBS volumes, DynamoDB tables, EFS file systems | S3: `GetBucketEncryption` for `ServerSideEncryptionConfiguration`. RDS: `DescribeDBInstances` check `StorageEncrypted = true`. EBS: `DescribeVolumes` check `Encrypted = true`. DynamoDB: `DescribeTable` check `SSEDescription.Status = ENABLED`. EFS: `DescribeFileSystems` check `Encrypted = true` | +| Encryption in transit | TLS enforced on all endpoints and data paths | S3 bucket policies, RDS instances, load balancer listeners, API Gateway endpoints | S3: bucket policy denies requests where `aws:SecureTransport = false`. RDS: check `ssl` parameter in parameter group. ALB/NLB: `DescribeListeners` check protocol is HTTPS/TLS. API Gateway: check `minimumCompressionSize` and endpoint type | +| Network isolation | No direct public internet ingress path to databases or internal-only services | RDS instances, Redshift clusters, ElastiCache clusters, security groups | RDS: `DescribeDBInstances` check `PubliclyAccessible = false`. Security Groups: `DescribeSecurityGroups` check no ingress rules allow `0.0.0.0/0` or `::/0` on database ports (3306, 5432, 1433, 6379, 27017) | +| No public S3 access | S3 Public Access Block enabled at bucket level unless explicitly exempted | All S3 buckets | `GetPublicAccessBlock` — all four settings (`BlockPublicAcls`, `IgnorePublicAcls`, `BlockPublicPolicy`, `RestrictPublicBuckets`) should be `true`. Also check `GetBucketPolicyStatus` for `IsPublic` | +| No exposed secrets | No hardcoded credentials, API keys, or secrets in resource configurations | Lambda environment variables, ECS task definitions, EC2 user data | Lambda: `GetFunctionConfiguration` inspect `Environment.Variables` for patterns matching keys/secrets. ECS: `DescribeTaskDefinition` inspect `containerDefinitions[].environment` and `secrets` | + +--- + +## Section 2: Compliance Baseline (Required — deviations are drift) + +These standards ensure operational governance and auditability. Deviations indicate compliance drift. + +| Policy | Expected State | Resources to Check | How to Verify | +|--------|---------------|-------------------|---------------| +| Resource tagging | All resources must have required tags: `Environment`, `Owner`, `CostCenter` | All taggable resources | Use `resourcegroupstaggingapi:GetResources` to discover untagged or partially-tagged resources. For each resource, verify presence of required tag keys. Acceptable `Environment` values: `production`, `staging`, `development` | +| CloudTrail logging | At minimum one organization or account-level trail active and logging | CloudTrail trails | `DescribeTrails` and `GetTrailStatus` — verify `IsLogging = true` and trail covers the current region. Check `S3BucketName` is set for log delivery | +| AWS Config recording | Config recorder active for supported resource types | AWS Config | `DescribeConfigurationRecorders` and `DescribeConfigurationRecorderStatus` — verify recorder exists and `recording = true` | +| Backup configuration | Automated backups enabled with retention period >= 7 days for production data stores | RDS instances, DynamoDB tables with PITR | RDS: `DescribeDBInstances` check `BackupRetentionPeriod >= 7`. DynamoDB: `DescribeContinuousBackups` check `PointInTimeRecoveryStatus = ENABLED` | + +--- + +## Section 3: Lifecycle Baseline (Drift if past end-of-support) + +Resources running deprecated or end-of-life software versions represent lifecycle drift. These accumulate security risk over time. + +| Resource Type | Drift Condition | How to Detect | +|---------------|----------------|---------------| +| Lambda runtimes | Runtime is deprecated or past AWS end-of-support date | `ListFunctions` then check `Runtime` field against AWS Lambda runtime deprecation schedule. Runtimes past Phase 2 deprecation (no creates or updates) are critical drift. Runtimes in Phase 1 (no creates) are high drift | +| RDS engine versions | Engine version past AWS end-of-standard-support | `DescribeDBInstances` check `EngineVersion` against RDS engine version lifecycle. Instances on versions past standard support are in extended support (incurs additional charges) or unsupported | +| EKS cluster versions | Kubernetes version past AWS end-of-standard-support | `DescribeClusters` check `version` against EKS Kubernetes version lifecycle. Clusters on versions past standard support are in extended support or unsupported | +| ECS AMI / platform versions | ECS-optimized AMI or Fargate platform version outdated | For EC2 launch type: check AMI age via `DescribeImages`. For Fargate: check `platformVersion` is `LATEST` or current supported version | + +--- + +## Section 4: Severity Classification + +Classify each drift finding based on the combination of risk exposure and blast radius. + +| Severity | Criteria | Examples | +|----------|----------|----------| +| **Critical** | Active security exposure with public-facing attack surface, or data loss risk | Unencrypted public S3 bucket with data, publicly accessible production database, missing CloudTrail (no audit trail), secrets in environment variables | +| **High** | Security gap not yet externally exploitable, or running past end-of-support | Missing encryption at rest on internal data store, no backups on production database, deprecated Lambda runtime past Phase 2, database port open to 0.0.0.0/0 in private subnet | +| **Medium** | Compliance gap with no immediate security risk, or approaching end-of-support | Missing required tags, Config recorder not active, Lambda runtime approaching deprecation, backup retention below 7 days | +| **Low** | Best practice deviation with minimal operational risk | Non-production resource without Multi-AZ, resource with `Owner` tag but missing `CostCenter`, Fargate not on latest platform version | + +--- + +## Section 5: AWS Config Rule Coverage Gap Analysis + +After evaluating resources against this baseline, check whether existing AWS Config rules provide automated enforcement for these policies. + +### How to analyze Config rule coverage: + +1. Call `DescribeConfigRules` to list all active Config rules +2. Map each rule to the policies in Sections 1-3 above +3. Identify policies that have NO corresponding Config rule — these are coverage gaps +4. For each gap, determine if an AWS managed rule exists that could enforce it + +### Common managed rules that map to this baseline: + +| Baseline Policy | AWS Config Managed Rule | +|----------------|------------------------| +| Encryption at rest (S3) | `s3-bucket-server-side-encryption-enabled` | +| Encryption at rest (RDS) | `rds-storage-encrypted` | +| Encryption at rest (EBS) | `encrypted-volumes` | +| No public S3 access | `s3-bucket-public-read-prohibited`, `s3-bucket-public-write-prohibited` | +| Network isolation (RDS) | `rds-instance-public-access-check` | +| Resource tagging | `required-tags` | +| Backup (RDS) | `db-instance-backup-enabled` | +| CloudTrail active | `cloud-trail-cloud-watch-logs-enabled` | + +Policies without available managed rules are candidates for custom Config rules. Flag these as recommendations. + +--- + +## Section 6: Extending This Baseline + +This baseline covers foundational security, compliance, and lifecycle standards. Organizations should extend it with: + +- **Application-specific policies**: latency thresholds, replication lag limits, scaling boundaries +- **Regulatory requirements**: HIPAA, PCI-DSS, SOC2-specific controls +- **Team conventions**: naming standards, cost allocation rules, environment separation + +Create additional skills with organization-specific policies and load them alongside this baseline for comprehensive drift detection. diff --git a/skills/drift-detection-baseline/evals/eval_queries.json b/skills/drift-detection-baseline/evals/eval_queries.json new file mode 100644 index 0000000..f0e882b --- /dev/null +++ b/skills/drift-detection-baseline/evals/eval_queries.json @@ -0,0 +1,27 @@ +[ + { + "query": "What is the capital of France?", + "should_trigger": false, + "reason": "General knowledge question unrelated to infrastructure drift" + }, + { + "query": "How do I deploy a Lambda function using SAM?", + "should_trigger": false, + "reason": "Deployment question, not drift detection" + }, + { + "query": "What EC2 instance type should I use for my web server?", + "should_trigger": false, + "reason": "Sizing question, not drift detection" + }, + { + "query": "How do I set up a VPC with public and private subnets?", + "should_trigger": false, + "reason": "Architecture design question, not drift detection" + }, + { + "query": "Explain how AWS CloudFormation works", + "should_trigger": false, + "reason": "General AWS service explanation, not drift detection" + } +] diff --git a/skills/drift-detection-baseline/evals/evals.json b/skills/drift-detection-baseline/evals/evals.json new file mode 100644 index 0000000..6f37fb3 --- /dev/null +++ b/skills/drift-detection-baseline/evals/evals.json @@ -0,0 +1,52 @@ +[ + { + "scenario": "An S3 bucket named 'customer-data-prod' has no server-side encryption configured and the Public Access Block is disabled (all four settings are false). The bucket has objects containing customer records. Evaluate this resource for drift against the baseline.", + "assertions": [ + "identifies encryption at rest violation", + "identifies public access block violation", + "classifies at least one finding as critical severity", + "mentions the specific S3 bucket", + "recommends enabling server-side encryption", + "recommends enabling public access block" + ] + }, + { + "scenario": "An RDS PostgreSQL instance 'orders-db' in production has PubliclyAccessible set to true, BackupRetentionPeriod set to 1 day, and StorageEncrypted set to false. Evaluate for drift.", + "assertions": [ + "identifies network isolation violation for PubliclyAccessible", + "identifies backup retention as below the 7-day requirement", + "identifies missing encryption at rest", + "classifies the publicly accessible database as critical or high severity", + "provides remediation guidance" + ] + }, + { + "scenario": "A Lambda function 'payment-processor' is running the nodejs14.x runtime. Another Lambda function 'report-generator' is running python3.9. Check these for lifecycle drift.", + "assertions": [ + "identifies nodejs14.x as deprecated or end-of-life", + "classifies the deprecated runtime as high severity or critical", + "recommends upgrading to a supported Node.js runtime", + "does not flag python3.9 as a lifecycle drift issue or flags it with lower severity than nodejs14.x" + ] + }, + { + "scenario": "Five EC2 instances are running in production. Three have the required tags (Environment, Owner, CostCenter) but two are missing the 'CostCenter' tag entirely and one is missing all three required tags. Evaluate tagging compliance.", + "assertions": [ + "identifies the instances missing required tags", + "reports missing CostCenter tag on two instances", + "reports all three missing tags on one instance", + "classifies tagging drift as medium severity", + "recommends adding the required tags" + ] + }, + { + "scenario": "A production AWS account has no AWS Config rules deployed. CloudTrail has one trail but GetTrailStatus shows IsLogging is false. Evaluate compliance drift.", + "assertions": [ + "identifies CloudTrail logging is disabled as drift", + "identifies no Config rules as a coverage gap", + "classifies disabled CloudTrail as critical or high severity", + "recommends enabling CloudTrail logging", + "recommends deploying Config rules for baseline policy enforcement" + ] + } +] From 979ca8a2d930ea469053ee8f0dc5cbc3be82c852 Mon Sep 17 00:00:00 2001 From: Harish Mandhadi Date: Sat, 18 Jul 2026 17:30:00 -0700 Subject: [PATCH 2/2] chore: ignore .kiro/settings in .gitignore --- .gitignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitignore b/.gitignore index 998d372..2808c67 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,6 @@ docs/custom-agents/*.md # Holmes .holmesignore + +# Kiro settings (may contain tokens) +.kiro/settings/