Stop 07 · Identity & SecurityTopics · 9/10

Cloud Security Posture Management

In short

One public S3 bucket or one wide-open security group is all it takes to land in the news. CSPM tools check every resource, all day, so you don't have to remember everything.

Continuously scanning your cloud environment for misconfigurations (public storage buckets, overly permissive IAM policies) — automated tools that catch what manual review inevitably misses at scale.

The blob character with a torch walks a corridor and finds one door wide open.

Think of it like this

The night watchman's rounds

Every night the society watchman walks every floor with a torch, tugging each door. He doesn't change anything himself; he notes "B-204 left open" and calls the owner. CSPM does those rounds across your cloud.

Watch it happen

A scan of eight resources

s3:logs

s3:photos

sg:web

sg:admin

iam:ci

rds:prod

ebs:vol1

s3:backup

1/5The scanner reads the configuration of every resource in the account through read-only APIs.

The big ideas

What you need to know

Continuous scans

Rules run against every resource on a schedule or on each change, not once before launch.

Benchmarks

Checks are grouped into standards like the CIS Benchmarks and AWS Foundational Security Best Practices.

Prioritise

Not every finding is urgent. A public bucket of customer data beats an unused, untagged volume.

Tools

AWS Security Hub and Config, Microsoft Defender for Cloud, Google Security Command Center, or open-source Prowler.

See it in code

Walk through the code

bash

1# Open-source scanner, run against your own account only2pip install prowler3prowler aws --severity high critical4 5# Or turn on AWS Security Hub with default standards6aws securityhub enable-security-hub --enable-default-standards

1/2Install and scan, showing only high and critical findings so the list stays readable.

Prowler uses your current AWS CLI credentials and needs read-only permissions like SecurityAudit and ViewOnlyAccess.

Save yourself the pain

Common mistakes

Oops

Turning on a CSPM tool and leaving 400 findings untouched.

Do this instead

Pick the top ten critical ones, fix them, then suppress what's truly accepted with a written reason.

Oops

Auto-remediating everything, like closing every open port instantly.

Do this instead

Auto-fix only safe, obvious cases. Others need a human so you don't break production.

Your mission

Run your first posture scan

~40 min

Quick check

What does a CSPM tool mainly look for?

Go deeper

1Explore a cloud provider's built-in security posture tool (e.g. AWS Security Hub, GCP Security Command Center).
2Learn to prioritize findings by severity rather than trying to fix everything at once.
3Understand why continuous scanning matters more than a one-time audit, since configurations drift over time.