What it does. Implement multi-cloud CSPM to detect cloud-native misconfigurations Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-cloud-vulnerability-posture-management/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-cloud-vulnerability-posture-management, or copy the skill folder into ~/.claude/skills/implementing-cloud-vulnerability-posture-management/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-vulnerability-posture-management/SKILL.md

SKILL.md (verbatim)

name: implementing-cloud-vulnerability-posture-management
description: Implement multi-cloud CSPM to detect cloud-native misconfigurations
  and vulnerabilities (IAM over-permissions, exposed storage, unencrypted data, missing
  network controls) using AWS Security Hub, Azure Defender for Cloud, and open-source
  Prowler and ScoutSuite scans, then aggregate results across clouds. Use when auditing
  multi-cloud environments for misconfiguration-driven vulnerabilities or building
  a consolidated cross-cloud posture report.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- cspm
- cloud-security
- aws-security-hub
- azure-defender
- prowler
- scoutsuite
- misconfiguration
- cnapp
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068
- T1078.004
- T1530

Implementing Cloud Vulnerability Posture Management

Overview

Cloud Security Posture Management (CSPM) continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks. Unlike traditional vulnerability scanning, CSPM focuses on cloud-native risks: IAM over-permissions, exposed storage buckets, unencrypted data, missing network controls, and service misconfigurations. This skill covers multi-cloud CSPM using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite.

When to Use

• When deploying or configuring implementing cloud vulnerability posture management capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• AWS CLI configured with SecurityAudit IAM policy
• Azure CLI with Security Reader role
• Python 3.9+ with boto3, azure-identity, azure-mgmt-security
• Prowler (https://github.com/prowler-cloud/prowler)
• ScoutSuite (https://github.com/nccgroup/ScoutSuite)

AWS Security Hub

Enable Security Hub

# Enable AWS Security Hub with default standards
aws securityhub enable-security-hub \
  --enable-default-standards \
  --region us-east-1

# Enable specific standards
aws securityhub batch-enable-standards \
  --standards-subscription-requests \
    '{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"}' \
    '{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/cis-aws-foundations-benchmark/v/1.4.0"}'

# Get findings summary
aws securityhub get-findings \
  --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}],"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}' \
  --max-items 10

Security Hub Standards

Standard	Description
AWS Foundational Security Best Practices	AWS-recommended baseline controls
CIS AWS Foundations Benchmark 1.4	CIS hardening requirements
PCI DSS v3.2.1	Payment card industry controls
NIST SP 800-53 Rev 5	Federal security controls

Azure Defender for Cloud

Enable Defender CSPM

# Enable Defender for Cloud free tier
az security pricing create \
  --name CloudPosture \
  --tier standard

# Check secure score
az security secure-score list \
  --query "[].{Name:displayName,Score:current,Max:max}" \
  --output table

# Get security recommendations
az security assessment list \
  --query "[?status.code=='Unhealthy'].{Name:displayName,Severity:metadata.severity,Resource:resourceDetails.id}" \
  --output table

# Get alerts
az security alert list \
  --query "[?status=='Active'].{Name:alertDisplayName,Severity:severity,Time:timeGeneratedUtc}" \
  --output table

Open-Source: Prowler

Installation and Execution

# Install Prowler
pip install prowler

# Run full AWS scan
prowler aws --output-formats json-ocsf,csv,html

# Run specific checks
prowler aws --checks s3_bucket_public_access iam_root_mfa_enabled ec2_sg_open_to_internet

# Run against specific AWS profile and region
prowler aws --profile production --region us-east-1 --output-formats json-ocsf

# Run CIS Benchmark compliance check
prowler aws --compliance cis_1.5_aws

# Run PCI DSS compliance
prowler aws --compliance pci_3.2.1_aws

# Scan Azure environment
prowler azure --subscription-ids "sub-id-here"

# Scan GCP environment
prowler gcp --project-ids "project-id-here"

Prowler Check Categories

Category	Examples
IAM	Root MFA, password policy, access key rotation
S3	Public access, encryption, versioning
EC2	Security groups, EBS encryption, metadata service
RDS	Public access, encryption, backup retention
CloudTrail	Enabled, encrypted, log validation
VPC	Flow logs, default SG restrictions
Lambda	Public access, runtime versions
EKS	Public endpoint, secrets encryption

Open-Source: ScoutSuite

# Install ScoutSuite
pip install scoutsuite

# Run AWS assessment
scout aws --profile production

# Run Azure assessment
scout azure --cli

# Run GCP assessment
scout gcp --project-id my-project

# Results available as interactive HTML report
# Open scout-report/report.html in browser

Multi-Cloud Aggregation

import json
import subprocess
from datetime import datetime, timezone

def run_prowler_scan(provider, output_dir, compliance=None):
    """Run Prowler scan for a cloud provider."""
    cmd = ["prowler", provider, "--output-formats", "json-ocsf",
           "--output-directory", output_dir]
    if compliance:
        cmd.extend(["--compliance", compliance])
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=3600)
    return result.returncode == 0

def aggregate_findings(prowler_dirs):
    """Aggregate findings from multiple Prowler scans."""
    all_findings = []
    for scan_dir in prowler_dirs:
        json_files = list(Path(scan_dir).glob("*.json"))
        for jf in json_files:
            with open(jf, "r") as f:
                for line in f:
                    try:
                        finding = json.loads(line.strip())
                        all_findings.append(finding)
                    except json.JSONDecodeError:
                        continue
    # Sort by severity
    severity_order = {"critical": 0, "high": 1, "medium": 2, "low": 3, "informational": 4}
    all_findings.sort(key=lambda f: severity_order.get(
        f.get("severity", "informational").lower(), 5
    ))
    return all_findings

def generate_posture_report(findings, output_path):
    """Generate cloud security posture report."""
    report = {
        "generated_at": datetime.now(timezone.utc).isoformat(),
        "total_findings": len(findings),
        "by_severity": {},
        "by_provider": {},
        "by_service": {},
    }
    for f in findings:
        sev = f.get("severity", "unknown")
        provider = f.get("cloud_provider", "unknown")
        service = f.get("service_name", "unknown")
        report["by_severity"][sev] = report["by_severity"].get(sev, 0) + 1
        report["by_provider"][provider] = report["by_provider"].get(provider, 0) + 1
        report["by_service"][service] = report["by_service"].get(service, 0) + 1

    with open(output_path, "w") as f:
        json.dump(report, f, indent=2)
    return report

References

• AWS Security Hub
• Azure Defender for Cloud
• Prowler
• ScoutSuite
• CIS Benchmarks

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Cloud Security Posture Management - Assessment Template

Scope Definition

• Cloud Providers: [ ] AWS [ ] Azure [ ] GCP
• Accounts/Subscriptions: [List accounts in scope]
• Compliance Framework: [ ] CIS Benchmark [ ] PCI DSS [ ] NIST 800-53 [ ] SOC 2
• Assessment Frequency: [ ] Daily [ ] Weekly [ ] Monthly

Critical Checks by Cloud Provider

AWS Priority Checks

• S3 buckets not publicly accessible
• Root account MFA enabled
• CloudTrail enabled in all regions
• IAM access keys rotated within 90 days
• Security groups no unrestricted inbound (0.0.0.0/0)
• RDS instances not publicly accessible
• EBS volumes encrypted
• VPC flow logs enabled

Azure Priority Checks

• Storage accounts not publicly accessible
• MFA enabled for all privileged accounts
• Activity log alerts configured
• NSG rules reviewed for unrestricted access
• SQL databases encrypted at rest
• Key Vault access policies reviewed
• Defender for Cloud enabled

GCP Priority Checks

• Cloud Storage buckets not publicly accessible
• 2FA enforced for all users
• Audit logging enabled
• Firewall rules reviewed
• Cloud SQL instances not publicly accessible
• VPC Service Controls configured

Report Deliverables

• Posture score by cloud account
• Failed checks by severity
• Compliance gap analysis
• Remediation priority list
• Month-over-month trend analysis

references/api-reference.md (verbatim)

API Reference: Cloud Security Posture Management Agent

Dependencies

Library	Version	Purpose
boto3	>=1.28	AWS SDK for Security Hub findings and compliance
prowler	>=4.0	Open-source cloud security scanner (optional, via subprocess)

CLI Usage

python scripts/agent.py \
  --profile security-audit \
  --region us-east-1 \
  --output-dir /reports/ \
  --output cspm_report.json

Functions

get_securityhub_client(profile, region)

Creates boto3 Security Hub client.

get_findings_summary(client, max_results) -> dict

Calls client.get_findings() filtered to NEW/ACTIVE findings, groups by severity.

get_compliance_summary(client) -> list

Calls client.get_enabled_standards() then describe_standards_controls() per standard. Returns compliance percentages.

run_prowler_scan(profile, region) -> dict

Executes prowler aws --output-formats json via subprocess with 10-minute timeout.

generate_report(client, profile, region) -> dict

Combines Security Hub and Prowler results into unified CSPM report.

boto3 Security Hub Methods

Method	Purpose
get_findings(Filters, MaxResults)	Retrieve active findings
get_enabled_standards()	List enabled compliance standards
describe_standards_controls(StandardsSubscriptionArn)	Control-level compliance

Output Schema

{
  "summary": {"finding_counts": {"CRITICAL": 3, "HIGH": 12}, "total_findings": 45},
  "compliance_standards": [{"standard": "cis-aws-foundations-benchmark", "compliance_pct": 78.5}],
  "recommendations": ["Remediate 3 CRITICAL findings immediately"]
}

references/standards.md (verbatim)

Standards and References - Cloud Vulnerability Posture Management

Cloud Security Standards

CIS Benchmarks for Cloud

• AWS: https://www.cisecurity.org/benchmark/amazon_web_services
• Azure: https://www.cisecurity.org/benchmark/azure
• GCP: https://www.cisecurity.org/benchmark/google_cloud_computing_platform
• Relevance: Prescriptive hardening guidance for cloud service configurations

NIST SP 800-53 Rev 5

• URL: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
• Key Controls: AC-6 (Least Privilege), CM-6 (Configuration Settings), SC-7 (Boundary Protection)

CSA Cloud Controls Matrix (CCM) v4

• URL: https://cloudsecurityalliance.org/research/cloud-controls-matrix
• Relevance: Cloud-specific security control framework aligned with major compliance standards

AWS Well-Architected Security Pillar

• URL: https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html

Azure Security Benchmark v3

• URL: https://learn.microsoft.com/en-us/security/benchmark/azure/overview

Tools

Tool	Provider	License	URL
AWS Security Hub	AWS	Pay-per-use	https://aws.amazon.com/security-hub/
Azure Defender for Cloud	Microsoft	Free + Standard tiers	https://azure.microsoft.com/en-us/products/defender-for-cloud
Prowler	Open Source	Apache 2.0	https://github.com/prowler-cloud/prowler
ScoutSuite	NCC Group	GPL-2.0	https://github.com/nccgroup/ScoutSuite
Steampipe	Turbot	AGPL-3.0	https://github.com/turbot/steampipe
CloudSploit	Aqua Security	GPL-3.0	https://github.com/aquasecurity/cloudsploit

references/workflows.md (verbatim)

Workflows - Cloud Vulnerability Posture Management

Workflow 1: Daily Cloud Posture Assessment

1. Prowler scans all cloud accounts (AWS, Azure, GCP) on daily schedule
2. Results exported as JSON-OCSF and uploaded to central SIEM
3. New critical/high findings trigger Slack notifications
4. Findings compared against previous day for delta analysis
5. New misconfigurations create Jira tickets for cloud team

Workflow 2: Compliance Baseline Assessment

1. Select compliance framework (CIS, PCI DSS, NIST 800-53, SOC 2)
2. Run Prowler with compliance flag against each cloud account
3. Generate compliance-specific report with pass/fail per control
4. Map failed controls to remediation actions
5. Track compliance posture score over time

Workflow 3: Remediation and Verification

1. Cloud engineer receives Jira ticket for misconfiguration
2. Engineer applies fix via Terraform/CloudFormation/ARM template
3. Targeted Prowler re-scan validates fix
4. Jira ticket auto-closed on pass
5. Infrastructure-as-code updated to prevent recurrence

Workflow 4: Multi-Cloud Executive Report

1. Aggregate findings from all providers
2. Calculate posture scores by account, region, and service
3. Trend analysis showing improvement or degradation
4. Risk heat map by cloud service category
5. Present to security leadership monthly

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.