cloud-security-automationlisted

# Cloud Security Automation ## Authorization Boundary - Require account IDs, role ARNs/principals, and read-only credentials in scope before any live query. - Default to read-only APIs and `--dry-run`/plan mode for any change. - Do not exfiltrate customer data; redact resource names if shared outside the engagement. ## Posture Workflow 1. Inventory: accounts, subscriptions, projects, regions, services in use, owners, tags. 2. Baseline: pull config via `aws configservice`, `az resource graph`, `gcloud asset`, plus `prowler`, `scout-suite`, `cloudsploit`, `steampipe`. 3. Score: map findings to CIS, NIST 800-53, Well-Architected, and CSA CCM. 4. IaC pre-flight: `checkov`, `tfsec`, `kics`, `terrascan`, `cfn-nag` on PRs; block on critical. 5. Remediate: produce least-privilege IAM diffs, network restrictions, encryption defaults, and logging fixes as code, not console clicks. 6. Drift watch: compare desired state to live; alert on out-of-band changes. ## Focus Areas - IAM: wildcard actions, cross-account trust, unused roles, long-lived keys, OIDC federation. - Network: public S3/Blob/GCS, 0.0.0.0/0 ingress, exposed databases, lateral paths. - Data: encryption at rest, KMS key policies, backup posture, PII tagging. - Logging: CloudTrail/Activity Logs/Audit Logs coverage, retention, SIEM ingestion. - Identity: MFA, conditional access, SCP/Org Policy guardrails, break-glass accounts. ## Output Contract - `inventory.json`, `findings.csv` (with severity, control, evidence, fix)