{
 "schema": "aiblocks-page/1",
 "id": "agency-security-cloud-security-architect",
 "type": "agent",
 "name": "Cloud security designer",
 "summary": "Describe your AWS, Azure or GCP setup. Get a posture checklist by area, each gap ranked, and the guardrail to add so it can't happen again.",
 "headline": "Cloud security designer",
 "subhead": "Describe your cloud accounts, identity setup and network layout. It checks each area, identity, network, data and logging, against known cloud breach patterns, and hands back the gaps ranked with a fix for each.",
 "job": {
  "id": "secure-code",
  "name": "Keep your code secure"
 },
 "level": "intermediate",
 "thinking": "high",
 "tested": true,
 "updated": "2026-11-03",
 "first_published": "2026-10-26",
 "inputs": [
  {
   "type": "question",
   "required": true,
   "label": "Question",
   "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like"
  },
  {
   "type": "source_text",
   "required": false,
   "label": "Source text",
   "what": "a long source in full: an article, a video or talk transcript, or notes from a book, with its title, author and link"
  },
  {
   "type": "codebase",
   "required": false,
   "label": "Codebase",
   "what": "a project's code, in a folder or repo the AI can open"
  }
 ],
 "outputs": [
  {
   "type": "audit_report",
   "required": true,
   "label": "Audit report",
   "what": "findings with evidence, severity, missing inputs and next actions"
  }
 ],
 "you_give": [
  "Your cloud provider (AWS, Azure, GCP, or more than one) and how your accounts or projects are organized.",
  "How identity works today: who has admin access, whether MFA is enforced, how services authenticate to each other.",
  "Your network layout: what's public, what's private, what's reachable from the internet.",
  "What data you store and how sensitive it is (optional, sharpens the data-protection checks).",
  "A security posture export (AWS Security Hub, Azure Defender, GCP Security Command Center), if you have one (optional)."
 ],
 "you_get": [
  "A posture checklist across five areas: identity, network, data, logging and compute, each marked Pass, Gap or Unknown.",
  "A ranked gap list: the issue, the breach pattern it matches, and the fix.",
  "A guardrail list: preventive policies (SCPs, Azure Policies, Organization Policies) that stop the mistake from recurring.",
  "The assumptions it made and what you should confirm before you trust a \"Pass.\""
 ],
 "use_when": [
  "You're setting up a new AWS, Azure or GCP account and want a security baseline before you go live.",
  "You want a second look at your IAM policies, security groups or storage buckets before a launch or an audit.",
  "You're moving from a single account to multiple accounts or environments and want the guardrails planned first.",
  "A customer or auditor asks how your cloud environment is secured and you want a written answer."
 ],
 "skip_when": [
  "You want your application code reviewed for bugs. Use the Application security reviewer.",
  "You have an active breach or suspicious activity right now. Use the Security incident responder and act immediately.",
  "You need a formal SOC 2, ISO 27001 or HIPAA gap assessment signed off by a certified assessor. Use the Compliance Auditor agent as a starting point, then bring in a certified assessor."
 ],
 "output_sample": {
  "input": [
   "Your cloud provider and account or project structure",
   "How identity and authentication work today",
   "Your network layout: public versus private",
   "What data you store (optional)",
   "A posture export from Security Hub, Defender or Security Command Center (optional)"
  ],
  "prerequisites": [
   "An AI that can read files, if you attach a posture export"
  ],
  "output": [
   {
    "name": "Posture checklist",
    "contains": "Identity, network, data, logging and compute, each marked Pass, Gap or Unknown with the reason."
   },
   {
    "name": "Ranked gaps",
    "contains": "Each gap, the breach pattern it matches, its impact and the fix."
   },
   {
    "name": "Guardrails to add",
    "contains": "Preventive policies that stop the mistake from recurring, sized small, medium or large."
   },
   {
    "name": "Assumptions and checks",
    "contains": "What the agent assumed and which facts you still need to confirm."
   }
  ]
 },
 "output_shape": "POSTURE CHECKLIST\n  [Identity/Network/Data/Logging/Compute] <item> | <Pass, Gap or Unknown> | <evidence or reason>\n\nRANKED GAPS\n  <gap> | <breach pattern it matches> | <impact> | <fix>\n\nGUARDRAILS TO ADD\n  <policy or control> | <what it prevents> | <effort: small, medium or large>\n\nASSUMPTIONS AND CHECKS STILL NEEDED\n  <assumption or gap> | <what to verify>",
 "how_to_use": [
  "Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.",
  "Describe your cloud provider, account structure, identity setup and network layout.",
  "Attach a posture export if you have one (Security Hub, Defender for Cloud, Security Command Center).",
  "Say \"Run the posture check. Mark anything you can't verify as Unknown, not Pass.\"",
  "Fix every item marked Gap on identity and network first. Those are where breaches start.",
  "Turn the guardrail list into policy (SCPs, Org Policies) so the fix survives the next change, not just this one."
 ],
 "checks": [
  "The result addresses your actual task and cites the evidence used.",
  "Examples, role-play experience and targets are kept separate from verified results.",
  "Claims of tests, memory, tool access or completed actions match what actually happened."
 ],
 "next": [
  {
   "name": "Security audit evidence reviewer",
   "url": "https://useaiblocks.com/skills/copilot-audit-integrity",
   "why": "Security audit evidence reviewer"
  },
  {
   "name": "ISO 27001 audit planner",
   "url": "https://useaiblocks.com/skills/iso-27001-audit-planner",
   "why": "ISO 27001 audit planner"
  }
 ],
 "source": {
  "by": "Michael Sitarzewski and Agency Agents contributors",
  "repo": "msitarzewski/agency-agents",
  "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-cloud-security-architect.md",
  "licence": "MIT",
  "original_name": "Cloud Security Architect",
  "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219"
 },
 "credits": [
  {
   "title": "Cloud Security Architect",
   "by": "Michael Sitarzewski and Agency Agents contributors",
   "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-cloud-security-architect.md",
   "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions."
  }
 ],
 "files": [
  "LICENSE",
  "references/source-agent.md",
  "SETUP.md",
  "source.json"
 ],
 "links": {
  "page": "https://useaiblocks.com/agents/agency-security-cloud-security-architect",
  "markdown": "https://useaiblocks.com/agents/agency-security-cloud-security-architect.md",
  "json": "https://useaiblocks.com/agents/agency-security-cloud-security-architect.json",
  "instructions": "https://useaiblocks.com/skills/agency-security-cloud-security-architect/SKILL.md",
  "download": "https://useaiblocks.com/skills/agency-security-cloud-security-architect.zip",
  "api_item": "https://useaiblocks.com/api/v1/items/agency-security-cloud-security-architect",
  "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-cloud-security-architect",
  "mcp": "https://useaiblocks.com/mcp"
 }
}