implementing-cloud-security-posture-management skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. 'Continuously monitor multi-cloud environments (AWS, Azure, GCP) for Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/implementing-cloud-security-posture-management/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-cloud-security-posture-management, or copy the skill folder into ~/.claude/skills/implementing-cloud-security-posture-management/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-security-posture-management/SKILL.md

SKILL.md (verbatim)

name: implementing-cloud-security-posture-management
description: 'Continuously monitor multi-cloud environments (AWS, Azure, GCP) for
  misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite,
  AWS Security Hub, Microsoft Defender for Cloud, and GCP Security Command Center.
  Use for cross-cloud posture monitoring, CIS/SOC 2/PCI DSS compliance, or drift-detection
  workflows; not for runtime workload protection or application security testing.

  '
domain: cybersecurity
subdomain: cloud-security
tags:
- cloud-security
- cspm
- multi-cloud
- compliance
- prowler
- scoutsuite
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.IR-01
- ID.AM-08
- GV.SC-06
- DE.CM-01
mitre_attack:
- T1078.004
- T1530
- T1537
- T1580

Implementing Cloud Security Posture Management

When to Use

  • When establishing continuous security monitoring across AWS, Azure, and GCP environments
  • When compliance requirements demand automated posture assessment against CIS, SOC 2, or PCI DSS
  • When security teams need visibility into cloud misconfigurations across multiple accounts and subscriptions
  • When building a security operations workflow that detects and remediates drift from security baselines
  • When migrating workloads to the cloud and need to enforce security guardrails

Do not use for runtime workload protection (use CWPP tools like Falco or Aqua), for application security testing (use DAST/SAST tools), or for network intrusion detection (use cloud-native IDS like GuardDuty or Network Watcher).

Prerequisites

  • Multi-cloud credentials with read-only security audit permissions across all target environments
  • Prowler v3+ installed (pip install prowler)
  • ScoutSuite installed (pip install scoutsuite)
  • AWS Config, Azure Policy, and GCP Organization Policy enabled in respective environments
  • Central logging destination (S3 bucket, Log Analytics Workspace, or Cloud Storage) for findings aggregation
  • Notification channels configured (Slack, PagerDuty, email) for critical finding alerts

Workflow

Step 1: Deploy Cloud-Native CSPM Services

Enable the built-in CSPM capabilities in each cloud provider for baseline posture assessment.

# AWS: Enable Security Hub with FSBP and CIS standards
aws securityhub enable-security-hub --enable-default-standards
aws securityhub batch-enable-standards --standards-subscription-requests \
  '[{"StandardsArn":"arn:aws:securityhub:::standards/cis-aws-foundations-benchmark/v/1.4.0"}]'

# Azure: Enable Microsoft Defender for Cloud (CSPM tier)
az security pricing create --name CloudPosture --tier standard
az security auto-provisioning-setting update --name default --auto-provision on

# GCP: Enable Security Command Center Premium
gcloud services enable securitycenter.googleapis.com
gcloud scc settings update --organization=ORG_ID \
  --enable-asset-discovery

Step 2: Run Prowler for Multi-Cloud Assessment

Execute Prowler to perform comprehensive security checks across all three cloud providers.

# AWS assessment with all CIS checks
prowler aws \
  --profile production \
  -M json-ocsf csv html \
  -o ./prowler-results/aws/ \
  --compliance cis_1.4_aws cis_1.5_aws

# Azure assessment
prowler azure \
  --subscription-ids SUB_ID_1 SUB_ID_2 \
  -M json-ocsf csv html \
  -o ./prowler-results/azure/ \
  --compliance cis_2.0_azure

# GCP assessment
prowler gcp \
  --project-ids project-1 project-2 \
  -M json-ocsf csv html \
  -o ./prowler-results/gcp/ \
  --compliance cis_2.0_gcp

# View summary across all providers
prowler aws --list-compliance

Step 3: Run ScoutSuite for Cross-Cloud Comparison

Use ScoutSuite for a unified multi-cloud security assessment with visual reporting.

# Scan AWS
python3 -m ScoutSuite aws --profile production \
  --report-dir ./scoutsuite/aws/

# Scan Azure
python3 -m ScoutSuite azure --cli \
  --all-subscriptions \
  --report-dir ./scoutsuite/azure/

# Scan GCP
python3 -m ScoutSuite gcp --user-account \
  --all-projects \
  --report-dir ./scoutsuite/gcp/

# Each produces an HTML report with risk-scored findings

Step 4: Build Automated Compliance Monitoring Pipeline

Create a scheduled pipeline that runs CSPM checks daily and routes findings to appropriate channels.

# Create a daily Prowler scan with EventBridge + CodeBuild (AWS)
cat > buildspec.yml << 'EOF'
version: 0.2
phases:
  install:
    commands:
      - pip install prowler
  build:
    commands:
      - prowler aws -M json-ocsf -o s3://security-findings-bucket/prowler/$(date +%Y%m%d)/
      - prowler aws --compliance cis_1.5_aws -M csv -o s3://security-findings-bucket/prowler/compliance/
  post_build:
    commands:
      - |
        CRITICAL=$(cat output/*.json | grep -c '"CRITICAL"')
        if [ "$CRITICAL" -gt 0 ]; then
          aws sns publish --topic-arn arn:aws:sns:us-east-1:ACCOUNT:security-alerts \
            --subject "Prowler: $CRITICAL critical findings" \
            --message "Review at s3://security-findings-bucket/prowler/$(date +%Y%m%d)/"
        fi
EOF

# Schedule with EventBridge
aws events put-rule \
  --name daily-prowler-scan \
  --schedule-expression "cron(0 6 * * ? *)" \
  --state ENABLED

Step 5: Configure Finding Aggregation and Deduplication

Aggregate findings from multiple CSPM tools and cloud providers into a unified view.

# findings_aggregator.py - Normalize and deduplicate CSPM findings
import json
import hashlib
from datetime import datetime

def normalize_finding(finding, source):
    """Normalize findings from different CSPM tools to a common format."""
    normalized = {
        'id': hashlib.sha256(f"{finding.get('ResourceId','')}{finding.get('CheckId','')}".encode()).hexdigest()[:16],
        'source': source,
        'cloud': finding.get('Provider', 'unknown'),
        'account': finding.get('AccountId', finding.get('SubscriptionId', '')),
        'region': finding.get('Region', ''),
        'resource_type': finding.get('ResourceType', ''),
        'resource_id': finding.get('ResourceId', ''),
        'severity': finding.get('Severity', 'INFO').upper(),
        'status': finding.get('Status', 'FAIL'),
        'title': finding.get('CheckTitle', finding.get('Title', '')),
        'description': finding.get('StatusExtended', ''),
        'compliance': finding.get('Compliance', {}),
        'remediation': finding.get('Remediation', {}).get('Recommendation', {}).get('Text', ''),
        'timestamp': datetime.utcnow().isoformat()
    }
    return normalized

def aggregate_findings(prowler_file, scoutsuite_file):
    findings = {}
    for file_path, source in [(prowler_file, 'prowler'), (scoutsuite_file, 'scoutsuite')]:
        with open(file_path) as f:
            for line in f:
                raw = json.loads(line)
                normalized = normalize_finding(raw, source)
                if normalized['status'] == 'FAIL':
                    findings[normalized['id']] = normalized
    return sorted(findings.values(), key=lambda x: {'CRITICAL':0,'HIGH':1,'MEDIUM':2,'LOW':3}.get(x['severity'],4))

Step 6: Implement Drift Detection and Auto-Remediation

Set up automated responses to configuration drift that violates security baselines.

# AWS Config auto-remediation for non-compliant S3 buckets
aws configservice put-remediation-configurations --remediation-configurations '[{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "TargetType": "SSM_DOCUMENT",
  "TargetId": "AWS-DisableS3BucketPublicReadWrite",
  "Parameters": {
    "S3BucketName": {"ResourceValue": {"Value": "RESOURCE_ID"}}
  },
  "Automatic": true,
  "MaximumAutomaticAttempts": 3,
  "RetryAttemptSeconds": 60
}]'

# Azure Policy for auto-remediation
az policy assignment create \
  --name "enforce-storage-encryption" \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9" \
  --scope "/subscriptions/SUB_ID" \
  --enforcement-mode Default

# GCP Organization Policy constraint
gcloud resource-manager org-policies set-policy policy.yaml --organization=ORG_ID
# policy.yaml: constraint: constraints/storage.publicAccessPrevention, enforcement: true

Key Concepts

Term Definition
CSPM Cloud Security Posture Management, the practice of continuously monitoring cloud infrastructure for misconfigurations and compliance violations
Configuration Drift Unintended changes to cloud resource configurations that deviate from the approved security baseline over time
Security Baseline A documented set of minimum security configuration requirements that all cloud resources must meet
Compliance Framework A structured set of security controls and requirements (CIS, SOC 2, PCI DSS, NIST) against which cloud configurations are evaluated
Finding Severity Risk classification of a misconfiguration based on exploitability and potential impact (Critical, High, Medium, Low, Informational)
Auto-Remediation Automated corrective action that restores a non-compliant resource to its required configuration without manual intervention

Tools & Systems

  • Prowler: Open-source multi-cloud security assessment tool with 300+ checks aligned to CIS, PCI DSS, HIPAA, and NIST
  • ScoutSuite: Multi-cloud security auditing tool producing risk-scored HTML reports from API-collected configuration data
  • AWS Security Hub: AWS-native CSPM with aggregated findings and compliance standard evaluation
  • Microsoft Defender for Cloud: Azure-native CSPM with secure score, regulatory compliance, and workload protection
  • GCP Security Command Center: GCP-native security platform with asset inventory, vulnerability scanning, and compliance monitoring

Common Scenarios

Scenario: Establishing CSPM for a Multi-Cloud Enterprise

Context: An enterprise runs production workloads across AWS (primary), Azure (identity and Microsoft services), and GCP (data analytics). The security team needs unified posture visibility.

Approach:

  1. Enable cloud-native CSPM in each provider: Security Hub, Defender for Cloud, SCC
  2. Deploy Prowler scans as daily scheduled jobs in each environment via CI/CD pipelines
  3. Normalize and aggregate findings into a central data lake using the aggregation script
  4. Build dashboards in Grafana or Kibana showing posture scores by cloud, account, and severity
  5. Configure auto-remediation for known-good fixes (public access blocks, encryption enablement)
  6. Route CRITICAL findings to PagerDuty for immediate response and HIGH findings to Jira tickets
  7. Produce weekly compliance reports for executive stakeholders showing trend data

Pitfalls: Running CSPM tools with overly broad permissions creates a high-value target. Use dedicated service accounts with read-only permissions and rotate credentials regularly. Different CSPM tools may report the same misconfiguration differently, so deduplication logic must account for varying resource ID formats and finding titles across tools.

Output Format

Cloud Security Posture Management Dashboard
==============================================
Organization: Acme Corp
Assessment Date: 2026-02-23
Environments: AWS (12 accounts), Azure (8 subscriptions), GCP (5 projects)

POSTURE SCORES:
  AWS:   82/100  (+3 from last week)
  Azure: 76/100  (-1 from last week)
  GCP:   79/100  (+5 from last week)
  Overall: 79/100

FINDINGS BY SEVERITY:
  Critical:  18 (AWS: 7, Azure: 8, GCP: 3)
  High:      67 (AWS: 28, Azure: 24, GCP: 15)
  Medium:   234 (AWS: 98, Azure: 87, GCP: 49)
  Low:      412 (AWS: 178, Azure: 134, GCP: 100)

TOP FAILING CATEGORIES:
  1. IAM overly permissive policies     (43 findings)
  2. Encryption not enabled at rest      (38 findings)
  3. Public network exposure             (29 findings)
  4. Logging and monitoring gaps         (24 findings)
  5. Unused credentials and keys         (19 findings)

AUTO-REMEDIATION (Last 7 Days):
  Findings auto-remediated:  34
  Manual remediation pending: 51
  Exceptions approved:        8

Other files in this skill

SKILL.es.md (verbatim)

name: implementing-cloud-security-posture-management description: > Implementing Cloud Security Posture Management (CSPM) to continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and GCP Security Command Center. domain: cybersecurity subdomain: cloud-security tags: [cloud-security, cspm, multi-cloud, compliance, prowler, scoutsuite] version: "1.0" author: mahipal license: Apache-2.0 language: es

Implementación de Gestión de Postura de Seguridad en la Nube (CSPM)

Cuándo Utilizar

  • Al establecer monitoreo continuo de seguridad en entornos AWS, Azure y GCP
  • Cuando los requisitos de cumplimiento demandan evaluación automatizada de postura contra CIS, SOC 2 o PCI DSS
  • Cuando los equipos de seguridad necesitan visibilidad de las configuraciones incorrectas en la nube en múltiples cuentas y suscripciones
  • Al construir un flujo de trabajo de operaciones de seguridad que detecte y remedie desviaciones de las líneas base de seguridad
  • Al migrar cargas de trabajo a la nube y se necesita aplicar controles de seguridad

No utilizar para protección de cargas de trabajo en tiempo de ejecución (use herramientas CWPP como Falco o Aqua), para pruebas de seguridad de aplicaciones (use herramientas DAST/SAST), ni para detección de intrusiones en red (use IDS nativos de la nube como GuardDuty o Network Watcher).

Requisitos Previos

  • Credenciales multi-nube con permisos de auditoría de seguridad de solo lectura en todos los entornos objetivo
  • Prowler v3+ instalado (pip install prowler)
  • ScoutSuite instalado (pip install scoutsuite)
  • AWS Config, Azure Policy y GCP Organization Policy habilitados en los respectivos entornos
  • Destino central de registros (bucket S3, Log Analytics Workspace o Cloud Storage) para agregación de hallazgos
  • Canales de notificación configurados (Slack, PagerDuty, correo electrónico) para alertas de hallazgos críticos

Flujo de Trabajo

Paso 1: Desplegar Servicios CSPM Nativos de la Nube

Habilitar las capacidades CSPM integradas en cada proveedor de nube para la evaluación de postura de referencia.

# AWS: Habilitar Security Hub con estándares FSBP y CIS
aws securityhub enable-security-hub --enable-default-standards
aws securityhub batch-enable-standards --standards-subscription-requests \
  '[{"StandardsArn":"arn:aws:securityhub:::standards/cis-aws-foundations-benchmark/v/1.4.0"}]'

# Azure: Habilitar Microsoft Defender for Cloud (nivel CSPM)
az security pricing create --name CloudPosture --tier standard
az security auto-provisioning-setting update --name default --auto-provision on

# GCP: Habilitar Security Command Center Premium
gcloud services enable securitycenter.googleapis.com
gcloud scc settings update --organization=ORG_ID \
  --enable-asset-discovery

Paso 2: Ejecutar Prowler para Evaluación Multi-Nube

Ejecutar Prowler para realizar verificaciones de seguridad exhaustivas en los tres proveedores de nube.

# Evaluación de AWS con todas las verificaciones CIS
prowler aws \
  --profile production \
  -M json-ocsf csv html \
  -o ./prowler-results/aws/ \
  --compliance cis_1.4_aws cis_1.5_aws

# Evaluación de Azure
prowler azure \
  --subscription-ids SUB_ID_1 SUB_ID_2 \
  -M json-ocsf csv html \
  -o ./prowler-results/azure/ \
  --compliance cis_2.0_azure

# Evaluación de GCP
prowler gcp \
  --project-ids project-1 project-2 \
  -M json-ocsf csv html \
  -o ./prowler-results/gcp/ \
  --compliance cis_2.0_gcp

# Ver resumen en todos los proveedores
prowler aws --list-compliance

Paso 3: Ejecutar ScoutSuite para Comparación Cross-Cloud

Usar ScoutSuite para una evaluación de seguridad multi-nube unificada con informes visuales.

# Escanear AWS
python3 -m ScoutSuite aws --profile production \
  --report-dir ./scoutsuite/aws/

# Escanear Azure
python3 -m ScoutSuite azure --cli \
  --all-subscriptions \
  --report-dir ./scoutsuite/azure/

# Escanear GCP
python3 -m ScoutSuite gcp --user-account \
  --all-projects \
  --report-dir ./scoutsuite/gcp/

# Cada uno produce un informe HTML con hallazgos puntuados por riesgo

Paso 4: Construir Pipeline Automatizado de Monitoreo de Cumplimiento

Crear un pipeline programado que ejecute verificaciones CSPM diariamente y enrute los hallazgos a los canales apropiados.

# Crear escaneo diario de Prowler con EventBridge + CodeBuild (AWS)
cat > buildspec.yml << 'EOF'
version: 0.2
phases:
  install:
    commands:
      - pip install prowler
  build:
    commands:
      - prowler aws -M json-ocsf -o s3://security-findings-bucket/prowler/$(date +%Y%m%d)/
      - prowler aws --compliance cis_1.5_aws -M csv -o s3://security-findings-bucket/prowler/compliance/
  post_build:
    commands:
      - |
        CRITICAL=$(cat output/*.json | grep -c '"CRITICAL"')
        if [ "$CRITICAL" -gt 0 ]; then
          aws sns publish --topic-arn arn:aws:sns:us-east-1:ACCOUNT:security-alerts \
            --subject "Prowler: $CRITICAL hallazgos críticos" \
            --message "Revisar en s3://security-findings-bucket/prowler/$(date +%Y%m%d)/"
        fi
EOF

# Programar con EventBridge
aws events put-rule \
  --name daily-prowler-scan \
  --schedule-expression "cron(0 6 * * ? *)" \
  --state ENABLED

Paso 5: Configurar Agregación y Deduplicación de Hallazgos

Agregar hallazgos de múltiples herramientas CSPM y proveedores de nube en una vista unificada.

# findings_aggregator.py - Normalizar y deduplicar hallazgos CSPM
import json
import hashlib
from datetime import datetime

def normalize_finding(finding, source):
    """Normalizar hallazgos de diferentes herramientas CSPM a un formato común."""
    normalized = {
        'id': hashlib.sha256(f"{finding.get('ResourceId','')}{finding.get('CheckId','')}".encode()).hexdigest()[:16],
        'source': source,
        'cloud': finding.get('Provider', 'unknown'),
        'account': finding.get('AccountId', finding.get('SubscriptionId', '')),
        'region': finding.get('Region', ''),
        'resource_type': finding.get('ResourceType', ''),
        'resource_id': finding.get('ResourceId', ''),
        'severity': finding.get('Severity', 'INFO').upper(),
        'status': finding.get('Status', 'FAIL'),
        'title': finding.get('CheckTitle', finding.get('Title', '')),
        'description': finding.get('StatusExtended', ''),
        'compliance': finding.get('Compliance', {}),
        'remediation': finding.get('Remediation', {}).get('Recommendation', {}).get('Text', ''),
        'timestamp': datetime.utcnow().isoformat()
    }
    return normalized

def aggregate_findings(prowler_file, scoutsuite_file):
    findings = {}
    for file_path, source in [(prowler_file, 'prowler'), (scoutsuite_file, 'scoutsuite')]:
        with open(file_path) as f:
            for line in f:
                raw = json.loads(line)
                normalized = normalize_finding(raw, source)
                if normalized['status'] == 'FAIL':
                    findings[normalized['id']] = normalized
    return sorted(findings.values(), key=lambda x: {'CRITICAL':0,'HIGH':1,'MEDIUM':2,'LOW':3}.get(x['severity'],4))

Paso 6: Implementar Detección de Desviaciones y Auto-Remediación

Configurar respuestas automatizadas ante desviaciones de configuración que violen las líneas base de seguridad.

# Auto-remediación de AWS Config para buckets S3 no conformes
aws configservice put-remediation-configurations --remediation-configurations '[{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "TargetType": "SSM_DOCUMENT",
  "TargetId": "AWS-DisableS3BucketPublicReadWrite",
  "Parameters": {
    "S3BucketName": {"ResourceValue": {"Value": "RESOURCE_ID"}}
  },
  "Automatic": true,
  "MaximumAutomaticAttempts": 3,
  "RetryAttemptSeconds": 60
}]'

# Azure Policy para auto-remediación
az policy assignment create \
  --name "enforce-storage-encryption" \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9" \
  --scope "/subscriptions/SUB_ID" \
  --enforcement-mode Default

# Restricción de GCP Organization Policy
gcloud resource-manager org-policies set-policy policy.yaml --organization=ORG_ID
# policy.yaml: constraint: constraints/storage.publicAccessPrevention, enforcement: true

Conceptos Clave

Término Definición
CSPM Gestión de Postura de Seguridad en la Nube, la práctica de monitorear continuamente la infraestructura cloud en busca de configuraciones incorrectas y violaciones de cumplimiento
Desviación de Configuración Cambios no intencionados en las configuraciones de recursos cloud que se desvían de la línea base de seguridad aprobada con el tiempo
Línea Base de Seguridad Un conjunto documentado de requisitos mínimos de configuración de seguridad que todos los recursos cloud deben cumplir
Marco de Cumplimiento Un conjunto estructurado de controles y requisitos de seguridad (CIS, SOC 2, PCI DSS, NIST) contra los cuales se evalúan las configuraciones cloud
Severidad del Hallazgo Clasificación de riesgo de una configuración incorrecta basada en la explotabilidad y el impacto potencial (Crítico, Alto, Medio, Bajo, Informativo)
Auto-Remediación Acción correctiva automatizada que restaura un recurso no conforme a su configuración requerida sin intervención manual

Herramientas y Sistemas

  • Prowler: Herramienta de evaluación de seguridad multi-nube de código abierto con más de 300 verificaciones alineadas a CIS, PCI DSS, HIPAA y NIST
  • ScoutSuite: Herramienta de auditoría de seguridad multi-nube que produce informes HTML puntuados por riesgo a partir de datos de configuración recopilados por API
  • AWS Security Hub: CSPM nativo de AWS con hallazgos agregados y evaluación de estándares de cumplimiento
  • Microsoft Defender for Cloud: CSPM nativo de Azure con puntuación de seguridad, cumplimiento regulatorio y protección de cargas de trabajo
  • GCP Security Command Center: Plataforma de seguridad nativa de GCP con inventario de activos, escaneo de vulnerabilidades y monitoreo de cumplimiento

Escenarios Comunes

Escenario: Establecer CSPM para una Empresa Multi-Nube

Contexto: Una empresa ejecuta cargas de trabajo de producción en AWS (principal), Azure (identidad y servicios Microsoft) y GCP (analítica de datos). El equipo de seguridad necesita visibilidad unificada de la postura.

Enfoque:

  1. Habilitar CSPM nativo de la nube en cada proveedor: Security Hub, Defender for Cloud, SCC
  2. Desplegar escaneos de Prowler como trabajos programados diariamente en cada entorno mediante pipelines CI/CD
  3. Normalizar y agregar hallazgos en un data lake central usando el script de agregación
  4. Construir dashboards en Grafana o Kibana mostrando puntuaciones de postura por nube, cuenta y severidad
  5. Configurar auto-remediación para correcciones conocidas (bloqueos de acceso público, habilitación de cifrado)
  6. Enrutar hallazgos CRÍTICOS a PagerDuty para respuesta inmediata y hallazgos ALTOS a tickets de Jira
  7. Producir informes semanales de cumplimiento para los ejecutivos mostrando datos de tendencias

Errores comunes: Ejecutar herramientas CSPM con permisos excesivamente amplios crea un objetivo de alto valor. Use cuentas de servicio dedicadas con permisos de solo lectura y rote las credenciales regularmente. Diferentes herramientas CSPM pueden reportar la misma configuración incorrecta de manera diferente, por lo que la lógica de deduplicación debe tener en cuenta los formatos variables de ID de recurso y títulos de hallazgos entre herramientas.

Formato de Salida

Dashboard de Gestión de Postura de Seguridad en la Nube
========================================================
Organización: Acme Corp
Fecha de Evaluación: 2026-02-23
Entornos: AWS (12 cuentas), Azure (8 suscripciones), GCP (5 proyectos)

PUNTUACIONES DE POSTURA:
  AWS:   82/100  (+3 desde la semana pasada)
  Azure: 76/100  (-1 desde la semana pasada)
  GCP:   79/100  (+5 desde la semana pasada)
  General: 79/100

HALLAZGOS POR SEVERIDAD:
  Crítico:  18 (AWS: 7, Azure: 8, GCP: 3)
  Alto:     67 (AWS: 28, Azure: 24, GCP: 15)
  Medio:   234 (AWS: 98, Azure: 87, GCP: 49)
  Bajo:    412 (AWS: 178, Azure: 134, GCP: 100)

PRINCIPALES CATEGORÍAS CON FALLOS:
  1. Políticas IAM excesivamente permisivas     (43 hallazgos)
  2. Cifrado en reposo no habilitado             (38 hallazgos)
  3. Exposición de red pública                   (29 hallazgos)
  4. Brechas en registro y monitoreo             (24 hallazgos)
  5. Credenciales y claves sin uso               (19 hallazgos)

AUTO-REMEDIACIÓN (Últimos 7 Días):
  Hallazgos auto-remediados:      34
  Remediación manual pendiente:   51
  Excepciones aprobadas:           8

references/api-reference.md (verbatim)

API Reference: Implementing Cloud Security Posture Management

Libraries

Prowler (Multi-Cloud CSPM)

  • Install: pip install prowler
  • Docs: https://docs.prowler.com/
  • CLI: prowler aws --compliance cis_level1 -M json
  • Supported: AWS, Azure, GCP, Kubernetes
  • Compliance frameworks: CIS, SOC2, PCI-DSS, HIPAA, NIST 800-53, GDPR

boto3 (AWS Posture Checks)

  • Install: pip install boto3
  • Key services: S3, IAM, EC2, CloudTrail, Config, SecurityHub

ScoutSuite (Multi-Cloud Auditing)

AWS Posture Check APIs

Service Method Check
S3 get_public_access_block() Public access settings
S3 get_bucket_encryption() Default encryption
IAM get_account_summary() Root MFA status
IAM list_access_keys() Key age/rotation
EC2 describe_security_groups() Open ports (0.0.0.0/0)
CloudTrail get_trail_status() Logging active
Config describe_config_rules() Compliance rules

Prowler Check Categories

  • IAM: Access keys, MFA, password policy, root usage
  • Storage: S3 public access, encryption, versioning
  • Network: Security groups, VPC flow logs, NACLs
  • Logging: CloudTrail, Config, VPC flow logs
  • Encryption: EBS, RDS, S3, KMS key rotation

Severity Mapping

  • CRITICAL: Root MFA disabled, CloudTrail off, public DB
  • HIGH: S3 public access, open SSH/RDP, unencrypted volumes
  • MEDIUM: Key rotation >90d, missing tags, flow logs off
  • LOW: Informational findings, best practice suggestions

External References

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.