Cybersecurity & Risk5.0 · 0 ratings

Cloud Misconfiguration Hardening Reviewer

Audits cloud IaC or config snapshots for misconfigurations and outputs prioritized, fix-ready hardening steps.

Role-BasedStep-by-StepStructured-Output

Prompt

ROLE: You are a cloud security engineer reviewing infrastructure configuration for misconfigurations and drift.

CONTEXT:
- Cloud provider: [AWS_AZURE_GCP]
- Config / IaC provided: [PASTE_TERRAFORM_CLOUDFORMATION_OR_CONFIG_EXPORT]
- Workload sensitivity: [WHAT_RUNS_HERE]
- Compliance baseline: [CIS_BENCHMARK_OR_OTHER]

TASK — review against these domains:
1. Identity & access: over-permissive IAM, wildcard policies, unused privileged roles, missing MFA on privileged identities.
2. Network exposure: open security groups (0.0.0.0/0), public storage buckets/blobs, exposed management ports, missing private endpoints.
3. Data protection: encryption at rest/in transit, key management, public snapshots/AMIs.
4. Logging & monitoring: missing audit trails (CloudTrail/Activity Log), no flow logs, alerting gaps.
5. Resilience: backup, multi-AZ, and deletion-protection settings.

For each finding: severity, the exact resource/line, why it's dangerous, and a corrected config snippet.

OUTPUT FORMAT:
- Findings table | Severity | Domain | Resource | Issue | CIS ref | Fix
- Remediation snippets (code blocks) for the top issues
- Quick-win checklist (fix in <1 day)

CONSTRAINTS: Reference CIS Benchmark control numbers where applicable. Provide least-privilege replacements, not just 'restrict it.' Never recommend disabling logging. Flag anything that exposes data publicly as Critical.

How to use this prompt

  1. 1

    Copy the prompt above and paste it into ChatGPT, Claude, or Gemini — or open it in the visual Studio to edit each part on a canvas and run it with your own key.

  2. 2

    Replace any bracketed placeholders with your specifics. The more concrete your context and constraints, the sharper the result — see the 5-part prompt structure.

  3. 3

    Run it, then refine. Ask the model to critique and improve its own answer with self-critique prompting.

Techniques in this prompt

Role-Based

Assigns the model an expert persona so it adopts the right vocabulary, depth, and standards for the task.

Learn this technique
Step-by-Step

Forces explicit intermediate reasoning instead of jumping to a conclusion, which improves accuracy on hard tasks.

Learn this technique
Structured Output

Pins the response to a defined structure so it drops straight into your workflow.

Learn this technique

Recommended models

claudegpt-4ogemini

Build on this prompt

Open it in the visual Studio to wire it into a full workflow with your own API key — or learn the craft behind prompts like this.

Open in Studio How to prompt AI correctly

More in Cybersecurity & Risk

STRIDE Threat Model For A New Service

Builds a structured STRIDE threat model for a system with trust boundaries, ranked threats, and concrete mitigations.

Read prompt

Security Incident Postmortem Author

Drafts a blameless post-incident review with timeline, root cause, and corrective actions ready for leadership.

Read prompt

CVE Triage And Prioritization Analyst

Triages a list of CVEs by exploitability and business context to produce an actionable patch priority queue.

Read prompt

Phishing Email Forensic Examiner

Analyzes a suspicious email's headers, URLs, and payload to classify intent and recommend SOC response.

Read prompt