# Cloud Posture

> Cloud Posture

- Skill: `trendmicro/cloud-posture` (Agent Skill)
- Install (CLI): `npx skillmds@latest add trendmicro/cloud-posture`
- Raw SKILL.md: https://api.skillmd.com/api/skills/trendmicro/cloud-posture/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: trendmicro (https://skillmd.com/u/trendmicro)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/trendmicro/cloud-posture

---

# Cloud Posture

Manage cloud security posture, compliance scanning, and security settings across cloud environments using Trend Micro Vision One. This skill includes both read and write operations for posture management.

## Instructions

1. When the user asks about cloud posture, compliance, or cloud security configuration, use this skill to query and manage posture data.

2. **Check posture status**: Start with `get_cloud_posture_overview` to understand the current compliance and posture state.

3. **List compliance findings**: Use `list_cloud_posture_findings` to identify misconfigurations and compliance violations.

4. **Review templates**: Use `list_cloud_posture_templates` to see available compliance templates and standards.

5. **Before write operations**: Always confirm with the user before executing any write operations (scan triggers, settings updates).

6. **Trigger scans**: Use `trigger_cloud_posture_scan` to initiate compliance scans when requested by the user.

7. **Update settings**: Use `update_cloud_posture_settings` to modify posture configurations with user approval.

8. **Track remediation**: Help users track which findings have been addressed and which remain open.

## Tools

This skill uses the following Vision One MCP tools:

### CSPM Accounts
| Tool | Purpose | Type |
|------|---------|------|
| `cloud_posture_accounts_list` | List all CSPM accounts | Read |

### Compliance Checks
| Tool | Purpose | Type |
|------|---------|------|
| `cloud_posture_account_checks_list` | List compliance checks for an account | Read |

### Scan Management
| Tool | Purpose | Type |
|------|---------|------|
| `cloud_posture_account_scan` | Start scanning a cloud posture account | Write |
| `cloud_posture_account_scan_settings_get` | Get scan settings for an account | Read |
| `cloud_posture_account_scan_settings_update` | Update scan settings (enabled/interval) | Write |

### Template Scanner
| Tool | Purpose | Type |
|------|---------|------|
| `cloud_posture_template_scanner_run` | Scan IaC templates (CloudFormation/Terraform) | Write |

### Cloud Risk Management
| Tool | Purpose | Type |
|------|---------|------|
| `cloud_risk_management_accounts_list` | List cloud accounts you can access | Read |
| `cloud_risk_management_account_scan_rules_get` | Get scan rule settings for an account | Read |
| `cloud_risk_management_services_list` | List cloud services and associated rules | Read |

## Common Workflows

### Compliance Assessment
1. Get posture overview for current state
2. List findings grouped by severity
3. Identify critical misconfigurations
4. Map findings to compliance frameworks
5. Prioritize remediation activities

### Compliance Scan Request
1. List available templates to identify scan scope
2. **Confirm with user** before triggering scan
3. Trigger cloud posture scan
4. Monitor scan progress
5. Review new findings after completion

### Posture Configuration Update
1. Review current settings
2. Discuss proposed changes with user
3. **Get explicit user approval** for changes
4. Apply settings update
5. Verify changes were applied successfully

### Remediation Tracking
1. List findings filtered by status
2. Identify findings marked for remediation
3. Check if remediated findings have been rescanned
4. Report on remediation progress
5. Highlight remaining open items

### Infrastructure as Code Scanning
1. Receive CloudFormation or Terraform template content
2. **Confirm with user** before scanning
3. Run template scanner
4. Review findings for misconfigurations
5. Report security issues before deployment
6. Recommend remediations for template issues

### Scan Rule Configuration
1. List cloud risk management accounts
2. Get scan rule settings for specific account
3. Review customized rules vs. defaults
4. List available services and rules
5. Document rule configuration for compliance

## Output Format

### Posture Overview
```
## Cloud Posture Summary

**Overall Compliance**: [%]
**Last Scan**: [Timestamp]

### Findings by Severity
- Critical: [count]
- High: [count]
- Medium: [count]
- Low: [count]

### Compliance by Framework
| Framework | Score | Pass | Fail |
|-----------|-------|------|------|
| CIS | [%] | [count] | [count] |
| SOC 2 | [%] | [count] | [count] |
| PCI DSS | [%] | [count] | [count] |
```

### Compliance Finding
```
## Finding: [Title]

**Severity**: [Critical/High/Medium/Low]
**Framework**: [CIS/SOC 2/etc.]
**Rule ID**: [ID]

### Description
[Finding description]

### Affected Resources
- [Resource type]: [Resource ID]

### Remediation
[Steps to remediate]

### Compliance Impact
- [Framework]: [Control ID]
```

### Write Operation Confirmation
```
## Action Required: [Operation Type]

**Operation**: [Description of what will be changed]
**Scope**: [What resources/settings will be affected]

### Current State
[Current configuration]

### Proposed Change
[What will change]

**Do you want to proceed with this operation? (yes/no)**
```

## Security Considerations

- **Write operations require explicit user confirmation** before execution
- Scan triggers may impact cloud API rate limits
- Settings changes affect security policy enforcement
- Document all configuration changes for audit purposes
- Critical findings should be addressed promptly
- Coordinate posture changes with cloud operations teams
- Test settings changes in non-production environments first when possible