hardening-cloud-posture

Hardening Cloud Posture

A CSPM scan returns a thousand findings. Almost none of them are the way in. The job is not to close a thousand findings; it is to find the handful that form an attack path and close those, then set guardrails so they cannot recur. Posture work that treats every finding as equal drowns the real one.

The organizing principle: identity is the perimeter. In cloud, the attack path is almost always a chain of IAM permissions, not a network hop. Rank by "what does this let a principal reach?", not by a scanner's severity label.

When to Use

• Reviewing an AWS/Azure/GCP account or organization's security posture
• Triaging a Prowler, ScoutSuite, Security Hub, or Defender for Cloud report
• Deciding which of many misconfigurations actually matter
• Setting preventive guardrails (SCPs, Azure Policy, org policies)
• Enabling the logging and controls an investigation will later depend on

When NOT to Use

• Actively investigating a live incident — use investigating-aws-incidents, investigating-azure-incidents, or investigating-gcp-incidents
• Attacking the environment to prove the path — use exploiting-cloud-platforms
• Kubernetes cluster-plane hardening — use defending-kubernetes
• Ranking CVEs in workloads rather than cloud config — use managing-vulnerabilities

Rank by Attack Path, Not Finding Count

Work findings in the order an attacker would exploit them, not the order the scanner lists them:

1. Public exposure of data or compute. Public S3/GCS buckets and storage accounts, publicly reachable databases, management ports open to 0.0.0.0/0. These need no credential — they are pre-authentication. Close first.
2. Identity that over-reaches. Wildcard Action/Resource policies, roles assumable by * or by external accounts without a condition, users with iam:PassRole to a privileged role, service principals with Owner. This is where a foothold becomes account-takeover.
3. Missing or disabled audit logging. CloudTrail not multi-region, GCP Data Access logs off, Azure diagnostic settings absent. This does not create the breach but it blinds the investigation — enable it now, because you cannot retroactively log the incident you are about to have.
4. Unencrypted data and absent key management. Real, but rarely the entry path. Fix after the above unless a compliance obligation reorders it.