Atmos AWS Compliance
SkillCloud & infraThis adds AWS compliance checking to your AI, so it can audit your AWS setup against standards like CIS, PCI DSS, SOC2, HIPAA, and NIST. Once added, your AI can run compliance checks, generate reports, and summarize the results for you.
Available today. Use it from your connected AI after setup.
No other account needed.
After adding it, ask your AI to run a compliance report, for example against CIS AWS or SOC2, and review the summary it gives you.
Then ask your AI: use the Atmos AWS Compliance skill
What your AI can do with it
- Run AWS compliance checks against CIS, PCI DSS, SOC2, HIPAA, and NIST standards
- Check your AWS environment against Security Hub standards
- Generate compliance reports from the results
- Work with different report formats
- Summarize findings so they are easier to review
What this skill tells your AI
The instructions your AI receives, as published by cloudposse/atmos in agent-skills/skills/atmos-aws-compliance/SKILL.md and read by ahel’s review.
Use this skill for compliance posture reporting through AWS Security Hub. It owns
atmos aws compliance report.
Command Model
atmos aws compliance report retrieves enabled Security Hub standard controls, maps failing
controls to Atmos stacks/components where possible, and writes reports for humans or automation.
atmos aws compliance report --framework cis-aws --stack prod-us-east-1
atmos aws compliance report --framework pci-dss --format json --file compliance.json
atmos aws compliance report --controls CIS.1.1,CIS.1.2 --format markdown
atmos aws compliance report --ai
Supported report formats are markdown, json, yaml, and csv.
Configuration
Configure defaults in atmos.yaml under aws.security. Route identity setup to atmos-auth.
aws:
security:
enabled: true
identity: security-readonly
region: us-east-2
frameworks:
- cis-aws
- pci-dss
Use --identity to override the configured identity for a run.
Frameworks
| Framework | Use |
|---|---|
cis-aws | CIS AWS Foundations Benchmark |
pci-dss | Payment Card Industry Data Security Standard |
soc2 | SOC 2 trust service criteria |
hipaa | HIPAA controls for protected health information |
nist | NIST 800-53 controls |
Agent Guidance
- Prefer
--frameworkfor targeted checks. Omit it only when the user explicitly wants all enabled frameworks. - Use
--stackwhen the report should map compliance status to a specific Atmos stack. - Use
--format jsonor--format yamlfor automation and CI gates; usemarkdownfor human reports. - Use
--filefor durable artifacts. Parent directories are created by the command. - Use
--aionly when the user asks for AI-generated summary or remediation guidance. - For detailed per-finding remediation output, route to
atmos-aws-security. - Do not invent compliance mappings. If component mapping is missing or low-confidence, say so and use Atmos introspection before proposing component changes.
Routing
| Need | Skill |
|---|---|
| Detailed security finding analysis and remediation format | atmos-aws-security |
| AWS identity/provider setup, SSO, SAML, OIDC, assume role/root | atmos-auth |
AI provider setup for --ai summaries | atmos-ai |
| Stack/component lookup before remediation | atmos-introspection, atmos-components |
Signals
- GitHub stars
- 1k
- Forks
- 175
- Last commit
- Sep 2026
ahel review
S4info
community integration — published by cloudposse, not aws
Automated review, not a security audit. Ruleset v1.
Advanced
- Catalog kind
- skill
- Gateway key
atmos-aws-compliance- Source
- github.com/cloudposse/atmos