Cloud Security Posture Management (CSPM): Automating AWS & GCP Guardrails

Attackers do not break into AWS or Google Cloud data centers; they simply write scripts that scan the IPv4 space for exposed Elasticsearch ports, open storage buckets, and overly permissive IAM keys committed to public GitHub repositories.

CSPM shifts security from manual point-in-time audits to continuous, automated policy enforcement. Using tools like AWS Security Hub, Prowler, and Terraform Sentinel, any unauthorized change is automatically remediated within seconds.

The most potent defense in a multi-account cloud architecture is an AWS Organizations Service Control Policy (SCP) attached to root organizational units. Even an account administrator or compromised root credential cannot override an SCP deny rule.

Below is a battle-tested SCP policy that forbids disabling bucket encryption, blocks public S3 bucket policies, and prevents deleting CloudTrail audit trails across all member accounts.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventDisablingCloudTrail",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:DeleteTrail",
        "cloudtrail:StopLogging",
        "cloudtrail:UpdateTrail"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EnforceS3BucketPublicAccessBlock",
      "Effect": "Deny",
      "Action": [
        "s3:PutAccountPublicAccessBlock",
        "s3:PutBucketPublicAccessBlock"
      ],
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalArn": ["arn:aws:iam::*:role/NateladSecurityAdmin"]
        }
      }
    },
    {
      "Sid": "BlockUnencryptedS3Uploads",
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::*/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}

When an engineer accidentally adds `0.0.0.0/0:22` to an EC2 security group, waiting for an auditor to discover it next quarter is unacceptable. Natelad configures AWS Config rules paired with Amazon EventBridge and Lambda functions that automatically revoke unauthorized ingress rules and dispatch an alert to the incident response channel within 4 seconds.