Implementing Cloud Security Posture Management

---
name: implementing-cloud-security-posture-management
description: Implementing Cloud Security Posture Management (CSPM) to continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite,
  AWS Security Hub, Azure Defender, and GCP Security Command Center.
tags:
- prowler
- cspm
- scoutsuite
- fetih
- cloud-security
- cybersecurity
- compliance
- siber-güvenlik
- multi-cloud
triggers:
- AWS
- Azure
- GCP
- alert
- api
- bulut güvenliği
- cloud
- cloud security
- email
- encryption
- exploit
- hash
category: cloud-security
source_subdomain: cloud-security
nist_csf:
- PR.IR-01
- ID.AM-08
- GV.SC-06
- DE.CM-01
adapted_for: fetih
---

# Implementing Cloud Security Posture Management


## Ne Zaman Kullanılır

- establishing yaparken: continuous security monitoring across AWS, Azure, and GCP environments
- compliance yaparken: requirements demand automated posture assessment against CIS, SOC 2, or PCI DSS
- security yaparken: teams need visibility into cloud misconfigurations across multiple accounts and subscriptions
- building yaparken a security operations workflow that tespit etme (s) and remediates drift from security baselines
- migrating yaparken workloads to the cloud and need to enforce security guardrails

**Kullanma:** for runtime workload protection (use CWPP tools like Falco or Aqua), for application security testing (use DAST/SAST tools), or for network intrusion Tespit (use cloud-native IDS like GuardDuty or Network Watcher).

## Ön Gereksinimler

- Multi-cloud credentials with read-only security audit permissions across all target environments
- Prowler v3+ kurulu (`pip install prowler`)
- ScoutSuite kurulu (`pip install scoutsuite`)
- AWS Config, Azure Policy, and GCP Organization Policy enabled in respective environments
- Central logging destination (S3 bucket, Log Analytics Workspace, or Cloud Storage) for Bul:ings aggregation
- Notification channels configured (Slack, PagerDuty, email) for critical Bul:ing alerts

## İş Akışı

### Adım 1: Dağıt: Cloud-Native CSPM Services

Enable the built-in CSPM capabilities in each cloud provider for baseline posture assessment.

```bash
aws securityhub enable-security-hub --enable-default-standards
aws securityhub batch-enable-standards --standards-subscription-requests \
  '[{"StandardsArn":"arn:aws:securityhub:::standards/cis-aws-foundations-benchmark/v/1.4.0"}]'

az security pricing create --name CloudPosture --tier standard
az security auto-provisioning-setting update --name default --auto-provision on

gcloud services enable securitycenter.googleapis.com
gcloud scc settings update --organization=ORG_ID \
  --enable-asset-discovery
```

### Adım 2: Run Prowler for Multi-Cloud Assessment

Execute Prowler to perform comprehensive security checks across all three cloud providers.

```bash
prowler aws \
  --profile production \
  -M json-ocsf csv html \
  -o ./prowler-results/aws/ \
  --compliance cis_1.4_aws cis_1.5_aws

prowler azure \
  --subscription-ids SUB_ID_1 SUB_ID_2 \
  -M json-ocsf csv html \
  -o ./prowler-results/azure/ \
  --compliance cis_2.0_azure

prowler gcp \
  --project-ids project-1 project-2 \
  -M json-ocsf csv html \
  -o ./prowler-results/gcp/ \
  --compliance cis_2.0_gcp

prowler aws --list-compliance
```

### Adım 3: Run ScoutSuite for Cross-Cloud Comparison

Use ScoutSuite for a unified multi-cloud security assessment with visual reporting.

```bash
python3 -m ScoutSuite aws --profile production \
  --report-dir ./scoutsuite/aws/

python3 -m ScoutSuite azure --cli \
  --all-subscriptions \
  --report-dir ./scoutsuite/azure/

python3 -m ScoutSuite gcp --user-account \
  --all-projects \
  --report-dir ./scoutsuite/gcp/

```

### Adım 4: Build Automated Compliance Monitoring Pipeline

Şunu oluştur: scheduled pipeline that runs CSPM checks daily and routes Bul:ings to appropriate channels.

```bash
cat > buildspec.yml << 'EOF'
phases:
  install:
    commands:
      - pip install prowler
  build:
    commands:
      - prowler aws -M json-ocsf -o s3://security-Bul:ings-bucket/prowler/$(date +%Y%m%d)/
      - prowler aws --compliance cis_1.5_aws -M csv -o s3://security-Bul:ings-bucket/prowler/compliance/
  post_build:
    commands:
      - |
        CRITICAL=$(cat output/*.json | grep -c '"CRITICAL"')
        if [ "$CRITICAL" -gt 0 ]; then
          aws sns publish --topic-arn arn:aws:sns:us-east-1:ACCOUNT:security-alerts \
            --subject "Prowler: $CRITICAL critical Bul:ings" \
            --message "Review at s3://security-Bul:ings-bucket/prowler/$(date +%Y%m%d)/"
        fi
EOF

aws events put-rule \
  --name daily-prowler-scan \
  --schedule-expression "cron(0 6 * * ? *)" \
  --state ENABLED
```

### Adım 5: Configure Bul:ing Aggregation and Deduplication

Aggregate Bul:ings from multiple CSPM tools and cloud providers into a unified view.

```python
import json
import hashlib
from datetime import datetime

def normalize_Bul:ing(Bul:ing, source):
    """Normalize Bul:ings from different CSPM tools to a common format."""
    normalized = {
        'id': hashlib.sha256(f"{Bul:ing.get('ResourceId','')}{Bul:ing.get('CheckId','')}".encode()).hexdigest()[:16],
        'source': source,
        'cloud': Bul:ing.get('Provider', 'unknown'),
        'account': Bul:ing.get('AccountId', Bul:ing.get('SubscriptionId', '')),
        'region': Bul:ing.get('Region', ''),
        'resource_type': Bul:ing.get('ResourceType', ''),
        'resource_id': Bul:ing.get('ResourceId', ''),
        'severity': Bul:ing.get('Severity', 'INFO').upper(),
        'status': Bul:ing.get('Status', 'FAIL'),
        'title': Bul:ing.get('CheckTitle', Bul:ing.get('Title', '')),
        'description': Bul:ing.get('StatusExtended', ''),
        'compliance': Bul:ing.get('Compliance', {}),
        'remediation': Bul:ing.get('Remediation', {}).get('Recommendation', {}).get('Text', ''),
        'timestamp': datetime.utcnow().isoformat()
    }
    return normalized

def aggregate_Bul:ings(prowler_file, scoutsuite_file):
    Bul:ings = {}
    for file_path, source in [(prowler_file, 'prowler'), (scoutsuite_file, 'scoutsuite')]:
        with open(file_path) as f:
            for line in f:
                raw = json.loads(line)
                normalized = normalize_Bul:ing(raw, source)
                if normalized['status'] == 'FAIL':
                    Bul:ings[normalized['id']] = normalized
    return sorted(Bul:ings.values(), key=lambda x: {'CRITICAL':0,'HIGH':1,'MEDIUM':2,'LOW':3}.get(x['severity'],4))
```

### Adım 6: Implement Drift Tespit and Auto-Remediation

Kur: automated responses to configuration drift that violates security baselines.

```bash
aws configservice put-remediation-configurations --remediation-configurations '[{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "TargetType": "SSM_DOCUMENT",
  "TargetId": "AWS-DisableS3BucketPublicReadWrite",
  "Parameters": {
    "S3BucketName": {"ResourceValue": {"Value": "RESOURCE_ID"}}
  },
  "Automatic": true,
  "MaximumAutomaticAttempts": 3,
  "RetryAttemptSeconds": 60
}]'

az policy assignment create \
  --name "enforce-storage-encryption" \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9" \
  --scope "/subscriptions/SUB_ID" \
  --enforcement-mode Default

gcloud resource-manager org-policies set-policy policy.yaml --organization=ORG_ID
```

## Key Concepts

| Term | Definition |
|------|------------|
| CSPM | Cloud Security Posture Management, the practice of continuously monitoring cloud infrastructure for misconfigurations and compliance violations |
| Configuration Drift | Unintended changes to cloud resource configurations that deviate from the approved security baseline over time |
| Security Baseline | A documented set of minimum security configuration requirements that all cloud resources must meet |
| Compliance Framework | A structured set of security controls and requirements (CIS, SOC 2, PCI DSS, NIST) against which cloud configurations are evaluated |
| Bul:ing Severity | Risk classification of a misconfiguration based on exploitability and potential impact (Critical, High, Medium, Low, Informational) |
| Auto-Remediation | Automated corrective action that restores a non-compliant resource to its required configuration without manual intervention |

## Tools & Systems

- **Prowler**: Open-source multi-cloud security assessment tool with 300+ checks aligned to CIS, PCI DSS, HIPAA, and NIST
- **ScoutSuite**: Multi-cloud security auditing tool producing risk-scored HTML reports from API-collected configuration data
- **AWS Security Hub**: AWS-native CSPM with aggregated Bul:ings and compliance standard evaluation
- **Microsoft Defender for Cloud**: Azure-native CSPM with secure score, regulatory compliance, and workload protection
- **GCP Security Command Center**: GCP-native security platform with asset inventory, vulnerability scanning, and compliance monitoring

## Common Scenarios

### Scenario: Establishing CSPM for a Multi-Cloud Enterprise

**Context**: An enterprise runs production workloads across AWS (primary), Azure (identity and Microsoft services), and GCP (data analytics). The security team needs unified posture visibility.

**Approach**:
1. Enable cloud-native CSPM in each provider: Security Hub, Defender for Cloud, SCC
2. Dağıt: Prowler scans as daily scheduled jobs in each environment via CI/CD pipelines
3. Normalize and aggregate Bul:ings into a central data lake using the aggregation script
4. Build dashboards in Grafana or Kibana showing posture scores by cloud, account, and severity
5. Configure auto-remediation for known-good fixes (public access blocks, encryption enablement)
6. Route CRITICAL Bul:ings to PagerDuty for immediate response and HIGH Bul:ings to Jira tickets
7. Produce weekly compliance reports for executive stakeholders showing trend data

**Pitfalls**: Running CSPM tools with overly broad permissions creates a high-value target. Use dedicated service accounts with read-only permissions and rotate credentials regularly. Different CSPM tools may Şunu raporla: same misconfiguration differently, so deduplication logic must account for varying resource ID formats and Bul:ing titles across tools.

## Output Format

```
Cloud Security Posture Management Dashboard
==============================================
Organization: Acme Corp
Assessment Date: 2026-02-23
Environments: AWS (12 accounts), Azure (8 subscriptions), GCP (5 projects)

POSTURE SCORES:
  AWS:   82/100  (+3 from last week)
  Azure: 76/100  (-1 from last week)
  GCP:   79/100  (+5 from last week)
  Overall: 79/100

Bul:INGS BY SEVERITY:
  Critical:  18 (AWS: 7, Azure: 8, GCP: 3)
  High:      67 (AWS: 28, Azure: 24, GCP: 15)
  Medium:   234 (AWS: 98, Azure: 87, GCP: 49)
  Low:      412 (AWS: 178, Azure: 134, GCP: 100)

TOP FAILING CATEGORIES:
  1. IAM overly permissive policies     (43 Bul:ings)
  2. Encryption not enabled at rest      (38 Bul:ings)
  3. Public network exposure             (29 Bul:ings)
  4. Logging and monitoring gaps         (24 Bul:ings)
  5. Unused credentials and keys         (19 Bul:ings)

AUTO-REMEDIATION (Last 7 Days):
  Bul:ings auto-remediated:  34
  Manual remediation pending: 51
  Exceptions approved:        8
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 3768c306a14bfa8f
-->