DevSecOps Practice Hub

Cloud Security Posture Management

Continuously assess deployed cloud configuration against benchmarks and remediate drift.

IntermediateCSPMCloudGovernance

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Operate Runtime security, secrets rotation and configuration reconciliation.
  • Monitor Detection engineering, SIEM, compliance evidence and incident response.

Overview

CSPM watches what is actually deployed, complementing IaC scanning which only sees what was declared. Manual changes and drift show up here.

Why it matters

Not everything is provisioned through pipelines. Posture management covers the gap between declared and actual state.

How it works

  1. 01Provider APIs are polled or change events are streamed.
  2. 02Resources are evaluated against benchmark rules.
  3. 03Findings route to owners; some can be auto-remediated.

Common tools

ProwlerCloud CustodianScoutSuiteAWSAzureIBM Cloud

Implementation examples

yamlAuto-remediate public S3 access
policies:  - name: s3-block-public-access    resource: aws.s3    filters:      - type: check-public-block        BlockPublicAcls: false    actions:      - type: set-public-block        BlockPublicAcls: true        BlockPublicPolicy: true
Validate in dry-run mode first; automatic remediation can break intentionally public buckets.

Best practices

  • Assign resource ownership via tags so findings can be routed.
  • Auto-remediate only well-understood, low-risk rules.

Common mistakes

  • Producing findings with no owner, so nothing is fixed.