Cloud Security Posture Management (CSPM)

Vibe Prompt

“Help me set up AWS Config Rules to automatically check: Is S3 open to public access? Are EBS volumes encrypted? Is RDS publicly accessible?”

What is CSPM?

Cloud Security Posture Management (CSPM) is a category of security solutions that continuously discovers, assesses, and remediates misconfigurations across cloud infrastructure. By comparing the actual state of resources against predefined security baselines—such as the CIS AWS Foundations Benchmark, PCI‑DSS, HIPAA, or internal corporate policies—CSPM tools provide visibility into compliance gaps and enable automated correction before attackers can exploit them.

Core Concepts

  • Asset Discovery: CSPM agents or API‑based connectors inventory every cloud resource (compute, storage, networking, identity, serverless, containers, etc.).
  • Configuration Assessment: Each resource’s configuration attributes are evaluated against rule sets that encode security best practices.
  • Continuous Monitoring: Unlike point‑in‑time scans, CSPM runs assessments on a near‑real‑time basis, triggering alerts when drift occurs.
  • Remediation Orchestration: Findings can trigger automated workflows (SSM documents, Lambda functions, Step Functions, or third‑party SOAR platforms) to fix misconfigurations without manual intervention.
  • Compliance Reporting: Aggregated results feed into dashboards and exportable reports for auditors, executives, and DevOps teams.

Why CSPM Matters: Business Value & Financial Return

Understanding the why helps developers, founders, and security leaders prioritize CSPM investments.

| Benefit | Explanation | Financial Impact | |---------|-------------|------------------| | Risk Reduction | Misconfigurations are the leading cause of cloud breaches (e.g., Capital One, Tesla). CSPM cuts the attack surface by eliminating low‑hanging fruit. | Avoids breach costs averaging $4.24 M per incident (IBM 2023). | | Regulatory Compliance | Standards like GDPR, HIPAA, SOC 2 require demonstrable controls over data protection. CSPM provides continuous evidence. | Reduces fines (up to 4 % of global turnover under GDPR) and audit preparation time. | | Operational Efficiency | Automated remediation frees engineers from manual ticket‑driven fixes, allowing focus on feature development. | Saves ~15 % of DevOps hours spent on firefighting; translates to faster time‑to‑market. | | Cost Optimization | Detects orphaned or over‑provisioned resources (e.g., unattached EBS volumes, idle RDS instances). | Direct savings on wasted spend; typical 10‑20 % reduction in cloud bills. | | Developer Empowerment | Guardrails built into CI/CD pipelines (IaC scanning, pre‑deploy CSPM checks) shift security left, reducing rework. | Lowers mean time to remediate (MTTR) from days to minutes, improving velocity. | | Investor Confidence | Demonstrating a mature security posture can be a differentiator in fundraising rounds and M&A due diligence. | Can increase valuation multiples by 5‑15 % for security‑focused SaaS companies. |

In short, CSPM is not just a security tool; it is a risk‑management, cost‑control, and productivity‑enhancing platform that directly contributes to the bottom line.

How CSPM Works: Step‑by‑Step Implementation with Vibe Coding

Below we walk through a practical implementation using AWS native services (Config, Security Hub, SSM) and illustrate how a “Vibe Coding” mindset—thinking in terms of desired outcomes and letting the tooling fill in the details—can accelerate delivery.

1. Define the Security Baseline

Start by selecting a benchmark. For AWS, the CIS AWS Foundations Benchmark v1.4 is a common starting point. Encode each rule as a managed Config rule or a custom Lambda‑based rule.

2. Deploy AWS Config

Config records configuration changes and evaluates them against rules.

# cdk/lib/cspm-stack.ts
import * as cdk from 'aws-cdk-lib';
import * as config from 'aws-cdk-lib/aws-config';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as ssm from 'aws-cdk-lib/aws-ssm';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as logs from 'aws-cdk-lib/aws-logs';

export class CspmStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // ---- S3 Public Read/Write Prevention ----
    new config.ManagedRule(this, 'S3PublicRead', {
      identifier: config.ManagedRuleIdentifiers.S3_BUCKET_PUBLIC_READ_PROHIBITED,
    });

    new config.ManagedRule(this, 'S3PublicWrite', {
      identifier: config.ManagedRuleIdentifiers.S3_BUCKET_PUBLIC_WRITE_PROHIBITED,
    });

    // ---- EBS Encryption ----
    new config.ManagedRule(this, 'EbsEncrypted', {
      identifier: config.ManagedRuleIdentifiers.ENCRYPTED_VOLUMES,
    });

    // ---- RDS Public Access ----
    new config.ManagedRule(this, 'RdsPublicAccess', {
      identifier: config.ManagedRuleIdentifiers.RDS_INSTANCE_PUBLIC_ACCESS_CHECK,
    });

    // ---- IAM User Without Policies ----
    new config.ManagedRule(this, 'IamUserNoPolicy', {
      identifier: config.ManagedRuleIdentifiers.IAM_USER_NO_POLICIES_CHECK,
    });

    // ---- Custom Rule: Ensure IMDSv2 on EC2 ----
    const imdsv2Rule = new config.CustomRule(this, 'Ec2ImdsV2Required', {
      lambdaFunction: new lambda.Function(this, 'ImdsV2CheckFn', {
        runtime: lambda.Runtime.NODEJS_20_X,
        handler: 'index.handler',
        code: lambda.Code.fromInline(`
          const AWS = require('aws-sdk');
          const config = new AWS.ConfigService();
          exports.handler = async (event) => {
            const invokingEvent = JSON.parse(event.invokingEvent);
            const configurationItem = invokingEvent.configurationItem;
            if (configurationItem.resourceType !== 'AWS::EC2::Instance') {
              return { complianceType: 'NOT_APPLICABLE' };
            }
            const metadataOptions = configurationItem.configuration.metadataOptions;
            const compliant = metadataOptions?.httpTokens === 'required';
            return {
              complianceType: compliant ? 'COMPLIANT' : 'NON_COMPLIANT',
              annotation: compliant ? 'IMDSv2 is required' : 'IMDSv2 is not enforced',
            };
          };
        `),
        timeout: cdk.Duration.seconds(30),
      }),
    });

    // ---- Remediation for S3 Public Access ----
    new config.RemediationConfiguration(this, 'RemediateS3Public', {
      targetType: config.RemediationTargetType.SSM_DOCUMENT,
      targetId: 'AWS-DisableS3BucketPublicReadWrite',
      parameters: [
        { name: 'BucketName', resourceValue: 'RESOURCE_ID' },
      ],
      automatic: true,
      executionControls: {
        ssmControls: { maxExecutionRate: 10, errorPercentage: 10 },
      },
    });

    // ---- Remediation for EBS Encryption (create encrypted snapshot & replace volume) ----
    new config.RemediationConfiguration(this, 'RemediateEbsEncryption', {
      targetType: config.RemediationTargetType.SSM_DOCUMENT,
      targetId: 'AWS-EncryptEBSVolume',
      parameters: [
        { name: 'VolumeId', resourceValue: 'RESOURCE_ID' },
        { name: 'KmsKeyId', staticValue: 'arn:aws:kms:${this.region}:${this.account}:key/your-key-id' },
      ],
      automatic: true,
      executionControls: {
        ssmControls: { maxExecutionRate: 5, errorPercentage: 20 },
      },
    });
  }
}

Explanation of the CDK snippet

  • Managed Rules: AWS provides pre‑built, maintained Config rules for common checks (S3 public access, encryption, etc.). Using them reduces code and ensures updates from AWS.
  • Custom Rule: Demonstrates how to write a Lambda‑based Config rule to enforce IMDSv2 on EC2 instances—a requirement not covered by managed rules.
  • Remediation Configurations: Link findings to SSM Automation Documents that perform corrective actions automatically (e.g., disabling public S3 access, encrypting an EBS volume).
  • Execution Controls: Throttle remediation to avoid rate‑limit issues and define acceptable error percentages.

3. Integrate with AWS Security Hub

Security Hub aggregates findings from Config, GuardDuty, Inspector, Macie, and third‑party tools, providing a single pane of glass.

# Enable Security Hub (once per account/region)
aws securityhub enable-security-hub --region us-east-1

# Import Config findings as Security Hub standards
aws securityhub batch-import-findings --findings file://config-findings.json

Why Security Hub adds value

  • Normalization: Findings from different sources are converted to the AWS Security Finding Format (ASFF), enabling correlation.
  • Insights: Built‑in insight rules highlight trends (e.g., “Multiple S3 buckets with public read in the same VPC”).
  • Automation: Security Hub can trigger CloudWatch Events or EventBridge to invoke Lambda remediation playbooks.

4. Extend to Multi‑Cloud with Open‑Source Tools

While AWS native services cover the AWS estate, many organizations run multi‑cloud. Tools like Prowler, ScoutSuite, and Checkov can be orchestrated via CI pipelines.

# .github/workflows/cspm.yml
name: CSPM Scan
on:
  push:
    branches: [ main ]
  schedule:
    - cron: '0 2 * * *'   # daily at 02:00 UTC

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Install Prowler
        run: |
          pip3 install prowler
      - name: Run AWS Prowler
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: prowler -M csv -r us-east-1,us-west-2 -o prowler-report.csv
      - name: Upload Report
        uses: actions/upload-artifact@v3
        with:
          name: prowler-report
          path: prowler-report.csv

5. Build Dashboards & Alerting

Create a CloudWatch Dashboard that visualizes Config rule compliance percentages over time, and set alarms for non‑compliant thresholds.

{
  "widgets": [
    {
      "type": "metric",
      "x": 0,
      "y": 0,
      "width": 12,
      "height": 6,
      "properties": {
        "metrics": [
          [ "AWS/Config", "ComplianceSum", "RuleName", "S3PublicRead", { "stat": "Sum", "label": "S3 Public Read" } ],
          [ ".", "ComplianceSum", "RuleName", "S3PublicWrite", { "stat": "Sum", "label": "S3 Public Write" } ],
          [ ".", "ComplianceSum", "RuleName", "EbsEncrypted", { "stat": "Sum", "label": "EBS Encryption" } ]
        ],
        "view": "timeSeries",
        "stacked": false,
        "region": "us-east-1",
        "title": "CSPM Compliance Trends",
        "period": 300
      }
    }
  ]
}

Set an alarm when the sum of non‑compliant resources exceeds zero for any critical rule.

6. Measure ROI

After 30 days of operation, capture metrics:

  • Number of misconfigurations detected vs. remediated.
  • Mean time to remediate (MTTR) before vs. after automation.
  • Cloud spend changes (identify and terminate idle resources).
  • Audit effort reduction (hours saved preparing compliance evidence).

Present these figures to stakeholders to justify continued investment and to fine‑tune rule sets (e.g., lower severity for noisy checks, raise severity for high‑risk findings).

Expanded Common Check Items

Below is a detailed matrix of resources, specific checks, associated risk levels, and recommended remediation actions.

| Resource | Check Description | Risk Level | Recommended Remediation | |----------|-------------------|------------|--------------------------| | S3 Bucket | Public read access allowed (s3:GetObject via public ACL or policy) | 🔴 High | Apply AWS-DisableS3BucketPublicReadWrite SSM doc; enforce bucket policies denying * principal; enable Block Public Access. | | S3 Bucket | Public write access allowed (s3:PutObject) | 🔴 High | Same as above; additionally enable MFA Delete for critical buckets. | | S3 Bucket | Lack of server‑side encryption (SSE‑S3, SSE‑KMS, or SSE‑C) | 🟡 Medium | Enable default encryption; use AWS-EnableS3BucketEncryption SSM doc. | | S3 Bucket | Versioning disabled | 🟡 Low | Enable versioning for recovery; use AWS-EnableS3BucketVersioning. | | S3 Bucket | No logging (access logs) | 🟡 Low | Configure access logging to a target bucket; enable via AWS-ConfigureS3AccessLogging. | | RDS Instance | Publicly accessible (publiclyAccessible: true) | 🔴 High | Set publiclyAccessible: false; place in private subnets; use AWS-ModifyRDSInstancePubliclyAccessible. | | RDS Instance | Storage not encrypted | 🟡 Medium | Enable encryption at rest; if already created, create encrypted snapshot and restore. | | RDS Instance | Automated backups disabled | 🟡 Low | Enable backup retention period > 0 days; set backup window. | | RDS Instance | No multi‑AZ deployment | 🟡 Low | Enable Multi‑AZ for HA; useful for production workloads. | | EC2 Instance | IMDSv1 enabled (allows SSRF attacks) | 🔴 High | Require IMDSv2 (metadata-options.http-tokens = required); use SSM doc AWS-EC2RequireIMDSv2. | | EC2 Instance | Security group open to 0.0.0.0/0 on ports 22, 3389, 1433, etc. | 🔴 High | Restrict inbound rules to specific IPs or security groups; use AWS-RestrictSecurityGroupIngress. | | EC2 Instance | No detailed monitoring (CloudWatch) | 🟡 Low | Enable detailed monitoring; helps with autoscaling and performance alerts. | | IAM User | No attached policies (effectively no permissions) | 🟡 Low | Either attach least‑privilege policies or delete the user if unnecessary. | | IAM User | MFA not enabled | 🔴 High | Enforce MFA via IAM policy (aws:MultiFactorAuthPresent) and require for console access. | | IAM User | Access keys older than 90 days | 🟡 Medium | Rotate keys regularly; automate with IAM credential report and Lambda rotation. | | IAM Role | Trust policy allows * principal | 🔴 High | Restrict trust to specific services/accounts; use condition keys like aws:SourceArn. | | Lambda Function | Publicly invoked via API Gateway without authorization | 🔴 High | Enable API Gateway authorizer (Cognito, JWT, or Lambda authorizer); set Authorization header requirement. | | Lambda Function | Execution role with overly permissive policies (e.g., AdministratorAccess) | 🔴 High | Downscope to least‑privilege policies; use AWS managed policies like AWSLambdaBasicExecutionRole plus specific resource permissions. | | Lambda Function | No dead‑letter queue (DLQ) configured | 🟡 Low | Configure DLQ (SQS or SNS) for async invocations to capture failures. | | KMS Key | Key rotation disabled | 🟡 Low | Enable automatic rotation (annual) for customer‑managed keys. | | KMS Key | Key policy allows * principal | 🔴 High | Restrict key usage to specific roles/users; use conditions. | | CloudTrail | Not enabled in all regions | 🔴 High |

Unlock Full Tutorial

This chapter is paid content. Join the project to unlock over 5000 words of deep analysis, including 10+ god-tier Prompts and real Source Code examples!

💳 View Payment Plans (NT$ 1999)Already purchased? Click here to login