Cloud Security Automation

Authorization Boundary

• Require account IDs, role ARNs/principals, and read-only credentials in scope before any live query.
• Default to read-only APIs and --dry-run/plan mode for any change.
• Do not exfiltrate customer data; redact resource names if shared outside the engagement.

Posture Workflow

1. Inventory: accounts, subscriptions, projects, regions, services in use, owners, tags.
2. Baseline: pull config via aws configservice, az resource graph, gcloud asset, plus prowler, scout-suite, cloudsploit, steampipe.
3. Score: map findings to CIS, NIST 800-53, Well-Architected, and CSA CCM.
4. IaC pre-flight: checkov, tfsec, kics, terrascan, cfn-nag on PRs; block on critical.
5. Remediate: produce least-privilege IAM diffs, network restrictions, encryption defaults, and logging fixes as code, not console clicks.
6. Drift watch: compare desired state to live; alert on out-of-band changes.

Focus Areas