fisc-to-aws-security-agent

Files (14)

• SKILL.md
• SKILL_ja.md
• aws_remediation_v13.json · config/
• pack_mapping.json · config/
• reference.md
• build_items.py · scripts/
• build_remediation_config.py · scripts/
• classify.py · scripts/
• extract_pdf.py · scripts/
• fisc_lib.py · scripts/
• generate_packs.py · scripts/
• requirements.txt · scripts/
• run_all.py · scripts/
• validate.py · scripts/

SKILL.md (first lines)

# FISC 安対基準 → AWS Security Agent Custom Requirements Conversion Skill

> Japanese version / 日本語版: [SKILL_ja.md](SKILL_ja.md)
> `SKILL.md` (this file, English) is the authoritative skill definition. `SKILL_ja.md` is a
> same-content Japanese mirror. Japanese users may rename `SKILL_ja.md` to `SKILL.md` to use it.
> Both files are maintained by the coding agent (Kiro), not edited by hand.

Given a FISC 安対基準 PDF as input, this skill generates source documents (Markdown) that can be
imported into AWS Security Agent as **Custom security requirements packs**.

The design goal is that **anyone who runs it gets the same result (deterministic and reproducible)**.
Classification uses an explicit definition file and field generation uses templates, so it does not
depend on ad-hoc LLM judgment.

---

## Assumptions and Constraints (must follow)

- **The operator supplies the input PDF.** This skill does not bundle any copyrighted PDF in the repository.
- **Security Agent evaluates at the workload (app/code/design) level.** Therefore, among the FISC
  standards, facility standards (physical facilities), audit standards (audit processes), and purely
  organizational/personnel controls are **excluded by default** (policy B: select workload-relevant
  technical controls). The focus is technical items of the practice standards plus control standards.
- **Field character limits** (Security Agent spec): name 80 / description 500 /
  applicability 10,000 / compliance criteria 10,000 / remediation guidance 10,000 (characters).
- **At most 20 items per pack**, and **each file <= 2MB** (upload constraints).
- Output is a draft. **After import, review and adjust the content in Security Agent.**
- Always refer to `reference.md` for detailed specs, pack definitions, exclusion policy, and customization.

---

## Workflow

```
FISC PDF
  → 1. extract_pdf : full-text extraction (with page markers)
  → 2. build_items : structured extraction of standard items (統/実/設/監 + number, title/summary/body/page)
  → 3. classify    : deterministic classification into 6 thematic packs per pack_mapping.json (non-matching excluded)
  → 4. generate    : convert each item into 5-field Markdown (1 item = 1 section)
  → 5. validate    : machine-check character counts, item count (<=20), and file size (<=2MB)
  → output/*.md    → upload to Security Agent Custom packs
```

## Usage

### One-shot run (recommended)

```bash
python3 ~/.kiro/skills/fisc-to-aws-security-agent/scripts/run_all.py \
    --pdf "<path to FISC 安対基準 PDF>" \
    --outdir ./output
```

- `output/NN_<pack_id>.md` is generated per pack, and `output/manifest.json` lists them.
- `--max-items` sets the per-pack limit (default 20); `--workdir` changes the intermediate output dir.
- Validation runs last; `✅ 検証OK` means all constraints are satisfied (exit code 1 on failure).

### Running individual steps

For troubleshooting or partial re-runs, run each script individually (see `reference.md`).

### Choosing the output format (upload vs manual registration)

`generate_packs.py` supports two output formats via `--format`.

- `--format upload` (default): one file per pack, to be **uploaded** to Security Agent for automatic
  requirement generation.
- `--format manual`: for **manually registering one item at a time in the console**. Each item's five
  fields (name / description / applicability / compliance / remediation) are split into copy-paste-ready
  `text` code blocks, annotated with **current character count and limit**, and **FISC category / source page**.

> On upload, Security Agent's automatic reinterpretation may split/merge items, translate to English,
> truncate descriptions, and lose FISC numbers (traceability). **If fidelity to the FISC original text
> and an audit trail are priorities, use `--format manual` for manual registration.**

Example of generating the manual format (regenerated from the intermediate `classified.json`, no PDF needed):

```bash
python3 ~/.kiro/skills/fisc-to-aws-security-agent/scripts/generate_packs.py \
    --classified ./output/_work/classified.json \
    --config ~/.kiro/skills/fisc-to-aws-security-agent/config/pack_mapping.json \
    --outdir ./output_manual \
    --format manual
```

### Adding AWS remediation guidance to the remediation field

For each requirement's **remediation guidance**, in addition to the FISC commentary source, this skill
appends the **AWS-proposed remediation ("What the customer should control" + "Supplementary information")**
(derived from the AWS-authored "FISC Security Guidelines Reference". **The "AWS response status" column is
NOT used**).

- The AWS data is stored in the skill-bundled config file **`config/aws_remediation_v<version>.json`**.
  This config holds **only AWS-authored columns** and **does not include any FISC 安対基準 body/commentary text**.
- `generate_packs.py` automatically selects the **highest version** among `config/aws_remediation_v*.json`.
- For each item code, it looks up AWS rows by both **exact match** (e.g. `実14-1`) and **base code**
  (`実14` with `-N` removed), de-duplicates, and appends them.
- To disable or pin: `--no-remediation` (do not append), `--remediation-config <path>` (pin a version).

**Generating the config file (from the AWS reference PDF):**

```bash
python3 ~/.kiro/skills/fisc-to-aws-security-agent/scripts/build_remediation_config.py \
    --pdf "<AWS-authored FISC reference.pdf>" \
    --version 13 \
    --out ~/.kiro/skills/fisc-to-aws-security-agent/config/aws_remediation_v13.json
```

### Replacement procedure when the 14th edition is published

When the AWS reference PDF for the 14th edition is published, the following switches over automatically
(do not bundle or store the FISC 安対基準 body PDF):

1. Run `build_remediation_config.py` against the **14th-edition PDF** with `--version 14 --out config/aws_remediation_v14.json`.
2. Place the generated `config/aws_remediation_v14.json` in the skill's `config/`.
3. From then on, `generate_packs.py` **auto-selects the highest version, v14** (the old v13 may be removed or kept).
4. Regenerate with `--format manual` etc., and the remediation guidance updates to the 14th-edition AWS content.

## Import procedure into Security Agent (performed by the operator)

From aws-samples/sample-fsi-reference-architecture-jp, MIT-0.

More from aws-samples/sample-fsi-reference-architecture-jp