CIS Benchmark
cis_benchmarkRead-onlyIdempotent
Run read-only CIS benchmark checks to evaluate cloud security posture across AWS, Azure, GCP, and Snowflake. Identifies failed checks with MITRE ATT&CK mappings.
Instructions
Run CIS benchmark checks against a cloud account.
Evaluates security posture against CIS Foundations Benchmarks:
- AWS Foundations v3.0: 18 checks (IAM, Storage, Logging, Networking)
- Snowflake v1.0: 12 checks (Auth, Network, Data Protection, Monitoring, Access Control)
- Azure Security Benchmark v3.0: 10 checks (IAM, Storage, Logging, Networking, Key Vault)
- GCP Foundation v3.0: 8 checks (IAM, Logging, Networking, Storage)
All checks are read-only. Failed checks include MITRE ATT&CK Enterprise technique mappings.
Requires appropriate credentials for the chosen provider.
Returns:
JSON with per-check pass/fail results, evidence, severity, ATT&CK techniques, and pass rate.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| provider | Yes | Cloud provider: 'aws', 'snowflake', 'azure', or 'gcp'. | |
| checks | No | Comma-separated check IDs to run (e.g. '1.1,2.1'). Omit to run all. | |
| region | No | AWS region (only for provider=aws). Defaults to us-east-1. | |
| profile | No | AWS CLI profile (only for provider=aws). | |
| subscription_id | No | Azure subscription ID (only for provider=azure). Falls back to AZURE_SUBSCRIPTION_ID env var. | |
| project_id | No | GCP project ID (only for provider=gcp). Falls back to GOOGLE_CLOUD_PROJECT env var. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |