Cloud Security Posture Management (CSPM) & CIS Benchmarks
When to Use This Skill
Triggers — load this skill when:
- A cloud account or organization needs a posture audit against CIS benchmarks
- Findings must be triaged, prioritized, and tracked to remediation
- Compliance evidence for control coverage is required
Route elsewhere when:
- Preventive policy gates before deploy ->
enterprise-iac-governance-terragrunt
- Identity policy authoring ->
aws-iam-zero-trust-policies
- Active intrusion response ->
secops-incident-triage-forensics
1. Automated Multi-Cloud Audit with Prowler
# Run AWS CIS Foundation Benchmark audit
prowler aws --compliance cis_2.0_aws -M json,csv,html -o /tmp/prowler-output
# Run Azure CIS Benchmark audit
prowler azure --compliance cis_2.0_azure
# Run GCP CIS Benchmark audit
prowler gcp --compliance cis_2.0_gcp
2. Top CIS Benchmark Critical Baselines
AWS CIS Hardening Checklist
Azure CIS Hardening Checklist
GCP CIS Hardening Checklist
3. Finding Triage, Least Privilege & Exceptions
A raw scanner report is not a plan. Rank every finding by exploitability × blast radius:
| Rank |
Shape of the finding |
Action window |
| P0 |
Internet-reachable + credential/data exposure (public bucket with PII, 0.0.0.0/0 to a database) |
Same day |
| P1 |
Privilege escalation path (iam:PassRole + wildcard, admin role without MFA) |
1 week |
| P2 |
Detection/logging gaps (CloudTrail off in a region, no flow logs) |
1 sprint |
| P3 |
Hygiene (missing tags, unused keys, weak password policy) |
Backlog |
Least privilege as a measurable target. Read access-analyzer/policy-simulator output and
compare granted actions against actions actually used in the last 90 days; drive the unused
share toward zero rather than chasing a "no wildcards" rule that teams will route around.
Exception register. Every accepted risk is a record with: finding ID, business
justification, compensating control, named owner, and an expiry date that reopens the
finding automatically. An exception without an expiry is a silent policy change.
4. Choosing the Scanner
| Tool |
Strength |
Use it for |
| Prowler |
Broadest CIS/NIST/PCI check library across AWS, Azure, GCP, Kubernetes; machine-readable output |
The recurring, pipeline-run compliance audit |
| ScoutSuite |
Multi-cloud, produces a browsable HTML attack-surface report with rich context |
Point-in-time review and handing findings to non-specialists |
| Cloud-native (Security Hub, Defender for Cloud, SCC) |
Continuous, no scanning infrastructure to run |
Always-on drift detection and alert routing |
scout aws --report-dir ./scout-report --no-browser # then review the HTML attack surface
scout gcp --organization-id 123456789012
Run one continuous native service and one independent scanner: native services score their
own provider's defaults generously, and an independent tool catches what the provider's checks
omit. Feed both into one findings register so the same misconfiguration is not tracked twice.
5. Anti-Patterns
| Anti-pattern |
Why it fails in production |
| Reporting the raw finding count as the security metric |
The number is dominated by low-severity hygiene items; it moves when the scanner updates its rule pack, not when risk changes. Track time-to-remediate for P0/P1 instead. |
| Enabling every check on day one and paging on all of them |
The first week produces thousands of findings, the channel gets muted, and the programme is dead. Start with the P0 class (internet-reachable + data or credential exposure), then widen. |
| Treating a passing CIS score as "we are secure" |
CIS covers configuration baselines only. It says nothing about a valid credential in an attacker's hands, a vulnerable application, or an over-broad but technically compliant IAM policy. |
| Auto-remediating findings without an owner |
Auto-closing a public S3 bucket that fronts a static site causes the outage the team remembers, and auto-remediation gets switched off permanently. Auto-remediate only classes that are provably safe, and notify the owner either way. |
| Silent, permanent exceptions |
An exception with no expiry is a policy change nobody approved. Every accepted risk carries a justification, a compensating control, a named owner, and a date that reopens it. |
| Running only the cloud provider's native scanner |
Native services grade their own provider's defaults generously. Pair one continuous native service with one independent scanner, and merge findings into a single register. |
1---2name: cloud-security-posture-cspm-cis3description: Cloud Security Posture Management: Prowler and ScoutSuite multi-cloud audits, CIS Benchmark baselines for AWS, Azure and GCP, over-permissive IAM discovery, and exception workflow. Use when auditing an account or organization's security posture, finding unused and over-permissive permissions across hundreds of roles, preparing for a CIS or compliance review, or triaging misconfiguration findings.4---56# Cloud Security Posture Management (CSPM) & CIS Benchmarks78## When to Use This Skill910**Triggers — load this skill when:**1112- A cloud account or organization needs a posture audit against CIS benchmarks13- Findings must be triaged, prioritized, and tracked to remediation14- Compliance evidence for control coverage is required1516**Route elsewhere when:**1718- Preventive policy gates before deploy -> `enterprise-iac-governance-terragrunt`19- Identity policy authoring -> `aws-iam-zero-trust-policies`20- Active intrusion response -> `secops-incident-triage-forensics`2122## 1. Automated Multi-Cloud Audit with Prowler2324```bash25# Run AWS CIS Foundation Benchmark audit26prowler aws --compliance cis_2.0_aws -M json,csv,html -o /tmp/prowler-output2728# Run Azure CIS Benchmark audit29prowler azure --compliance cis_2.0_azure3031# Run GCP CIS Benchmark audit32prowler gcp --compliance cis_2.0_gcp33```3435---3637## 2. Top CIS Benchmark Critical Baselines3839### AWS CIS Hardening Checklist4041- [ ] Root account MFA enabled and access keys deleted.42- [ ] AWS CloudTrail enabled in all regions with log file validation and KMS encryption.43- [ ] Default VPC security groups restrict all inbound and outbound traffic.44- [ ] AWS GuardDuty and Security Hub enabled organization-wide.4546### Azure CIS Hardening Checklist4748- [ ] Microsoft Defender for Cloud enabled on all subscriptions.49- [ ] Storage accounts require secure transfer (`https`) and TLS 1.2+.50- [ ] Disable public blob access across all storage accounts.5152### GCP CIS Hardening Checklist5354- [ ] OS Login enabled across all Compute Engine instances.55- [ ] Disallow default service account assignment to VMs with full API access.56- [ ] Uniform bucket-level access enabled on all Cloud Storage buckets.5758---5960## 3. Finding Triage, Least Privilege & Exceptions6162A raw scanner report is not a plan. Rank every finding by **exploitability × blast radius**:6364| Rank | Shape of the finding | Action window |65| --- | --- | --- |66| P0 | Internet-reachable + credential/data exposure (public bucket with PII, `0.0.0.0/0` to a database) | Same day |67| P1 | Privilege escalation path (`iam:PassRole` + wildcard, admin role without MFA) | 1 week |68| P2 | Detection/logging gaps (CloudTrail off in a region, no flow logs) | 1 sprint |69| P3 | Hygiene (missing tags, unused keys, weak password policy) | Backlog |7071**Least privilege as a measurable target.** Read access-analyzer/policy-simulator output and72compare granted actions against actions actually used in the last 90 days; drive the unused73share toward zero rather than chasing a "no wildcards" rule that teams will route around.7475**Exception register.** Every accepted risk is a record with: finding ID, business76justification, compensating control, named owner, and an **expiry date** that reopens the77finding automatically. An exception without an expiry is a silent policy change.7879---8081## 4. Choosing the Scanner8283| Tool | Strength | Use it for |84| --- | --- | --- |85| **Prowler** | Broadest CIS/NIST/PCI check library across AWS, Azure, GCP, Kubernetes; machine-readable output | The recurring, pipeline-run compliance audit |86| **ScoutSuite** | Multi-cloud, produces a browsable HTML attack-surface report with rich context | Point-in-time review and handing findings to non-specialists |87| Cloud-native (Security Hub, Defender for Cloud, SCC) | Continuous, no scanning infrastructure to run | Always-on drift detection and alert routing |8889```bash90scout aws --report-dir ./scout-report --no-browser # then review the HTML attack surface91scout gcp --organization-id 12345678901292```9394Run one continuous native service **and** one independent scanner: native services score their95own provider's defaults generously, and an independent tool catches what the provider's checks96omit. Feed both into one findings register so the same misconfiguration is not tracked twice.9798---99100## 5. Anti-Patterns101102| Anti-pattern | Why it fails in production |103| --- | --- |104| Reporting the raw finding count as the security metric | The number is dominated by low-severity hygiene items; it moves when the scanner updates its rule pack, not when risk changes. Track time-to-remediate for P0/P1 instead. |105| Enabling every check on day one and paging on all of them | The first week produces thousands of findings, the channel gets muted, and the programme is dead. Start with the P0 class (internet-reachable + data or credential exposure), then widen. |106| Treating a passing CIS score as "we are secure" | CIS covers configuration baselines only. It says nothing about a valid credential in an attacker's hands, a vulnerable application, or an over-broad but _technically compliant_ IAM policy. |107| Auto-remediating findings without an owner | Auto-closing a public S3 bucket that fronts a static site causes the outage the team remembers, and auto-remediation gets switched off permanently. Auto-remediate only classes that are provably safe, and notify the owner either way. |108| Silent, permanent exceptions | An exception with no expiry is a policy change nobody approved. Every accepted risk carries a justification, a compensating control, a named owner, and a date that reopens it. |109| Running only the cloud provider's native scanner | Native services grade their own provider's defaults generously. Pair one continuous native service with one independent scanner, and merge findings into a single register. |
mchittineni