service-approval

Plugin service-approval from marketplace service-approval in awslabs/service-onboarding-accelerator-on-aws. Commands read from the repo's manifest — 9 days ago.

Skills (23)

• assess

  Run a 5-domain CAF security posture assessment for an AWS service. Produces (1) assessment-summary.md — CAF-structured findings with GAPS tables, (2) sar-facts.json — extracted SAR data, (3) checkpoint-results.json — factual checkpoint verification. These feed into the research, validate, and genera

• generate-detective

  Generate detective control artifacts — Config rules with Lambda handlers, EventBridge rules, CloudWatch alarms, CloudTrail configuration — and responsive references to pre-authored AWS SSM Automation runbooks. Reads from mapping-results.json and validated.json.

• generate-preventive-iam

  The single IAM authority for preventive controls — authors IAM identity policies, trust policies, permission boundaries, resource-based policies, VPCE policies, and KMS key policies, each adapted from a matching reference example. Generates only for controls the recommender marked GENERATE_IAM with

• generate-preventive-rcp

  Author Resource Control Policies (RCPs) for preventive control objectives, adapted from a matching reference example. Generates only for controls the recommender marked GENERATE_RCP with a resolved reference anchor and an RCP-expressible service; never free-synthesizes. Reads preventive-plan.json, m

• generate-preventive-recommend

  Decide the enforcement mechanism for each preventive control objective — SCP, RCP, IAM, or "not preventable → detective/proactive" — and anchor each decision to a reference example. Runs first in the preventive sub-pipeline and gates the authoring sub-skills. Reads mapping-results.json, validated.js

• generate-preventive-rootcause

  Final critic for preventive generation — proves every authored preventive artifact is both reference-anchored and actually enforces the root cause of its control (a real condition key gates the target action). Runs last in the preventive sub-pipeline. Routes non-enforcing objectives to detective. Re

• generate-preventive-scp

  Author Service Control Policies (SCPs) for preventive control objectives, adapted from a matching reference example. Generates only for controls the recommender marked GENERATE_SCP with a resolved reference anchor; never free-synthesizes. Reads preventive-plan.json, mapping-results.json, validated.j

• generate-preventive

  Generate preventive and proactive security control artifacts — SCPs, resource policies, KMS key policies, permission boundaries, tag policies, OPA policies, and CloudFormation Guard rules. Reads from mapping-results.json and validated.json.

• generate-v3

  Generate all security control artifacts from mapping-results.json and validated.json. Split into focused sub-skills for better accuracy; this skill orchestrates them.

• intake

  Precursor intake phase for the Service Approval pipeline. Collects service name and input type. Produces intake-manifest.json consumed by all downstream phases. Supports file-based input (intake YAML) for repeatable, batch-friendly execution.

• map-assemble

  Deterministic assembly of map sub-skill outputs into final mapping-results.json, controls-catalog.md, and framework-mapping.md. Builds traceability, identifies coverage gaps, and runs comprehensive validation. No LLM reasoning required — pure data assembly.

• map-framework-mapping

  Map generated controls to framework objectives with per-objective analysis, coverage-level scoring, and strict quality gates. Produces map-framework-mapped.json consumed by map-assemble. The hardest sub-skill — requires careful per-objective reasoning, not batch keyword matching.

• map-generate-controls

  Generate security controls from mitigations x capabilities, organized by Category x Scope matrix. Produces map-controls-generated.json with rich metadata for downstream framework mapping. Consumes validated.json.

• map-parse-framework

  Parse a customer-provided control framework file (xlsx/json/md) into normalized framework_objectives[]. Produces map-framework-parsed.json consumed by map-assemble. Supports CCMv4, NIST 800-53, CIS Benchmarks, ISO 27001.

• map

  Map verified service capabilities against customer-provided control framework and threat model. Produces mapping-results.json, controls-catalog.md, and framework-mapping.md. Supports pluggable frameworks: CCMv4, NIST 800-53, CIS Benchmarks, ISO 27001, etc. Split into 4 focused sub-skills for better

• research-api-surface

  Discover the complete API surface for an AWS service — all operations (control-plane AND data-plane), parameters, and cross-reference validation against SAR condition keys. Produces research-api-surface.json consumed by the research merge step.

• research-attack-surface

  Identify applicable threat techniques for the target service based on API surface analysis and MITRE ATT&CK Cloud matrix (always runs). Enriched by customer threat model input (MITRE ATT&CK, STRIDE, or custom) when available. Produces research-attack-surface.json consumed by the research merge step.

• research-capabilities

  Discover AWS service security capabilities (IAM, encryption, network, logging, org-policies) using MCP servers and assessment artifacts. Produces research-capabilities.json consumed by the research merge step.

• research-mitigations

  Parse input files to extract existing mitigations, build initial asset inventory, and collect assessment gaps. Produces research-mitigations.json consumed by the research merge step.

• research-v3

  AWS service capability discovery producing research.json with structured capabilities, API surface, and existing mitigations. Uses MCP servers for AWS documentation, service authorization, and best practices. Downstream skills (Validate, Map) consume this output. Split into 3 focused sub-skills for

• service-approval-v3

  Orchestrate the service-approval agents (Intake → Assess → Research → Validate → Map → Recommended Guidance → Summarize) to generate AWS security controls for any AWS service

• summarize-v3

  Produce final SUMMARY-REPORT.md — a brief, service-first report that links out to the companion docs and coverage rollups

• validate-v3

  Verify research.json v3.0 findings via MCP — confirm capabilities, API parameters, condition keys, SCP/RCP expressibility, and mitigation feasibility. Produce validated.json.

Slash commands (1)

• /service-approval:service-approval

  Run the AWS service-approval pipeline — generates security controls for a specified AWS service

MCP servers (2)

• aws-documentation

  runs: uvx [email protected]

• awsknowledge

  connects to: https://knowledge-mcp.global.api.aws

Hooks (3)

• PreToolUse

  python3 "${CLAUDE_PLUGIN_ROOT}/tools/validate/hook_pre_tool_use.py"

• PostToolUse

  ${CLAUDE_PLUGIN_ROOT}/tools/validate/hook_post_tool_use.py

• Stop

  ${CLAUDE_PLUGIN_ROOT}/tools/validate/hook_stop.py

Similar plugins