How to Perform Cloud Security Posture Management in AWS
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
Cloud misconfigurations are the leading cause of cloud data breaches. Public S3 buckets, IAM roles with wildcard permissions, unencrypted databases, and security groups open to 0.0.0.0/0 are routinely exploited. Cloud Security Posture Management (CSPM) automates the continuous evaluation of your cloud configurations against security standards, replacing manual periodic audits with real-time detection. AWS provides native CSPM capability through Security Hub, Config Rules, and IAM Access Analyzer: this guide covers deploying and operationalizing these tools for meaningful security improvement.
Enable AWS Security Hub and Standards
Enable Security Hub in every account and region where you run workloads. In the AWS Console: Security Hub > Enable Security Hub. Or via CLI: aws securityhub enable-security-hub --enable-default-standards --region us-east-1. Security Hub automatically enables: CIS AWS Foundations Benchmark standard (29 controls), AWS Foundational Security Best Practices (200+ controls), and NIST SP 800-53 Rev 5 (optional, enable separately). In multi-account environments, designate a Security Hub administrator account using AWS Organizations integration: aws securityhub create-members --account-details to aggregate findings from all member accounts. This provides a centralized view across your entire AWS estate. Security Hub generates findings scored by severity (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL): focus initial remediation on CRITICAL and HIGH findings. The CIS Level 1 benchmark score gives you an overall posture percentage; track this weekly to measure improvement.
Deploy Critical Config Rules
AWS Config Rules evaluate configurations continuously. Enable these managed rules first: they cover the most commonly exploited misconfigurations: s3-bucket-public-read-prohibited (detects public S3 buckets), s3-account-level-public-access-blocks-periodic (verifies S3 Block Public Access enabled at account level), iam-root-access-key-check (alerts if root account has active access keys), mfa-enabled-for-iam-console-access (identifies IAM users without MFA), vpc-sg-open-only-to-authorized-ports (detects security groups with 0.0.0.0/0 on sensitive ports), rds-instance-public-access-check (finds publicly accessible RDS instances), cloudtrail-enabled (verifies CloudTrail is logging in all regions). Deploy via AWS CLI: aws configservice put-config-rule --config-rule file://rule.json. Via Terraform: use the aws_config_config_rule resource. For organization-wide deployment, use AWS Config Organization Rules: these apply automatically to all current and future member accounts.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Identify Public Exposure with IAM Access Analyzer
IAM Access Analyzer is the most accurate tool for finding resources with unintended public or cross-account access. Enable at the organization level: IAM > Access Analyzer > Create Analyzer > Zone of Trust: AWS Organization. This analyzes: S3 bucket policies (public or cross-account access), IAM role trust policies (cross-account assume role), KMS key policies (external principal access), Lambda function policies (public invocation), SQS queue policies (cross-account access), SNS topic policies. Access Analyzer generates findings for each external access grant. Review findings via CLI: aws accessanalyzer list-findings --analyzer-arn <arn> --filter '"status":{"eq":["ACTIVE"]}'. For each finding, determine if the access is intentional (archive the finding) or unintentional (remediate the policy). Common unintentional findings: S3 bucket policies with "Principal": "*", role trust policies with "AWS": "*", and Lambda resource policies from testing that were never removed. Run Access Analyzer on a new account before going live: start with a clean posture.
Find IAM Privilege Escalation Paths
Overly permissive IAM is the most dangerous misconfiguration because it enables attackers to escalate from a compromised low-privilege role to full admin. Automated tools for IAM privilege escalation analysis: PMapper (Principalmapper) maps IAM permissions across accounts and identifies paths from any principal to admin. Install: pip install principalmapper. Run: pmapper graph create --account 123456789012 then pmapper query "who can become admin?". This identifies principals that can call iam:CreateAccessKey, iam:AttachUserPolicy, iam:CreatePolicy, or other escalation actions on any user or role. AWS IAM Access Advisor shows last-used service data per role: aws iam generate-service-last-accessed-details --arn <role-arn>. Roles with dozens of services in their policy but only 2-3 services actually accessed in the past 90 days are candidates for permission reduction. AWS IAM's Permission Boundaries and Service Control Policies (SCPs) are the enforcement mechanisms: use SCPs to prevent any principal from ever calling iam:CreateLoginProfile, iam:UpdateLoginProfile, or s3:PutBucketPolicy in accounts that don't need those capabilities.
Automate Remediation for Critical Findings
Manual review of CSPM findings does not scale. Automate remediation for high-confidence, low-risk fixes using AWS Config Remediation Actions or EventBridge-triggered Lambda functions. Example: auto-enable S3 Block Public Access when Config detects a violation. AWS Config Remediation Action using SSM Automation: set the remediation action for s3-bucket-public-read-prohibited to the managed SSM document AWS-ConfigureS3BucketPublicAccessBlock. For custom remediation, create an EventBridge rule: Event Pattern matching Config Rule compliance change, Target: Lambda function that calls the S3 PutPublicAccessBlock API. Critical guardrail: only auto-remediate when you have high confidence the fix won't break production. Auto-remediate S3 public access blocking on development and staging accounts but require manual approval for production. Use AWS Step Functions to implement approval workflows: Config detects violation > SNS notification > human approves > Step Functions triggers Lambda remediation. Log all auto-remediations to CloudTrail and send to your SIEM for audit.
Evaluate Third-Party CSPM Tools
Native AWS tools cover AWS well but organizations with multi-cloud environments (AWS + Azure + GCP) need a single-pane CSPM. Leading tools: Wiz provides cross-cloud CSPM with attack path analysis that visualizes how misconfigurations chain together to create exploitable paths; it also correlates CSPM findings with vulnerability data and identity exposure. Prisma Cloud (Palo Alto Networks) offers the widest compliance framework coverage and deepest Kubernetes/container posture management. Orca Security uses agent-less scanning of cloud snapshots to detect OS-level vulnerabilities alongside misconfigurations without deploying agents. Lacework uses machine learning to establish behavioral baselines and detect anomalous account activity alongside configuration assessment. When evaluating: require the vendor to demonstrate their attack path analysis on your actual AWS environment: vendors that show conceptual attack paths rather than paths in your real infrastructure are selling concepts, not security. Key technical requirements: agentless deployment, cross-account role-based access (read-only, no long-lived credentials), API coverage for the services you actually use, and JIRA/ServiceNow integration for finding-to-ticket workflow.
Build a CSPM Metrics Dashboard
Track CSPM effectiveness with four metrics: (1) Mean Time to Detect (MTTD): average time between a misconfiguration being created and generating a finding; should be under 15 minutes for Config Rules; (2) Mean Time to Remediate (MTTR): average time from finding creation to resolution, by severity; track CRITICAL separately with a target under 24 hours; (3) CIS Benchmark score: percentage of CIS Level 1 and 2 controls passing, tracked weekly; (4) Open finding count by age: findings older than 30 days for CRITICAL severity indicate process failure. Build a Security Hub Insights to track these: Security Hub > Insights > Create Insight, filter by Severity and RecordState=ACTIVE, group by CreatedAt. Export Security Hub findings to S3 and visualize in Amazon QuickSight for executive dashboards. Set EventBridge rules to alert the on-call engineer when a CRITICAL finding appears: Security Hub > Findings > Create EventBridge Rule > Target SNS topic > PagerDuty integration.
The bottom line
AWS CSPM implementation starts with enabling Security Hub organization-wide (aggregates findings across all accounts), deploying the critical Config Rules covering S3 public access, IAM root keys, MFA enforcement, and open security groups, and enabling IAM Access Analyzer at the organization level to find external access grants. Prioritize CRITICAL findings and auto-remediate high-confidence low-risk fixes on non-production accounts. Track CIS Benchmark score weekly as your primary posture metric.
Frequently asked questions
What is the difference between AWS Security Hub and AWS Config for CSPM?
AWS Config evaluates resource configurations against individual rules and records configuration history: it is the detection engine that checks whether specific configurations comply with defined policies. AWS Security Hub aggregates findings from Config, GuardDuty, Inspector, Macie, and IAM Access Analyzer into a single console with severity scoring, benchmark compliance tracking, and cross-account visibility. For CSPM, you need both: Config Rules do the per-resource configuration checking, and Security Hub provides the centralized view and benchmark scoring across your AWS organization.
How do I find publicly exposed S3 buckets across all AWS accounts?
Use three tools in combination: AWS Config's s3-bucket-public-read-prohibited and s3-account-level-public-access-blocks-periodic rules detect buckets violating public access policies; IAM Access Analyzer identifies S3 bucket policies with external principal access (including public Principal:* grants); and AWS Macie scans bucket contents to identify buckets containing sensitive data (PII, credentials, financial records). Enable all three at the organization level via AWS Organizations to get coverage across all accounts without configuring each account individually.
How do I implement CSPM for a multi-account AWS Organization?
Multi-account AWS CSPM setup: designate a dedicated Security account as the AWS Security Hub administrator; enable Security Hub in every region and account across the Organization using AWS Organizations integration (this can be done via a single CloudFormation StackSet or AWS CLI Organizations command). Enable the AWS Foundational Security Best Practices (FSBP) standard and CIS AWS Foundations Benchmark in Security Hub — these two standards together cover the most critical misconfigurations. Configure Security Hub findings to flow into your SIEM (EventBridge rule to SNS or Lambda that forwards findings to Splunk or Sentinel). Assign remediation ownership by resource tag: if your resources are tagged with team or owner, route Security Hub findings to the appropriate team's JIRA or ticketing system automatically.
What is the AWS Well-Architected Framework Security Pillar and how does it relate to CSPM?
The AWS Well-Architected Framework Security Pillar defines best practices across six areas: IAM (least privilege), detection (CloudTrail, Config, GuardDuty), infrastructure protection (VPC security groups, WAF), data protection (encryption, key management), incident response (playbooks, automated response), and application security. CSPM tools operationalize the Security Pillar by continuously checking resource configurations against these best practices and alerting when they drift. The Security Hub FSBP standard maps directly to Well-Architected guidance: a 100% compliance score on FSBP corresponds closely to implementing the Security Pillar's foundational controls. Use the Well-Architected Tool in the AWS console to run a structured self-assessment against the Security Pillar alongside automated CSPM checking.
How do I automate remediation of AWS security misconfigurations?
Automated remediation via AWS Systems Manager Automation: create an Automation runbook for each common misconfiguration (e.g., 'enable S3 bucket encryption', 'remove public security group rule'), and trigger it via EventBridge when AWS Config or Security Hub creates a finding matching the rule. For simple remediations (turning on encryption, enabling logging): full automation with no human approval is appropriate. For impactful remediations (modifying security groups, disabling access): use an approval workflow where the runbook sends a notification and waits for manual approval before executing. Implement in phases: start with notification-only (no automated changes), build confidence in the detection accuracy, then enable automated remediation for low-risk findings, and expand gradually.
How do I use AWS Config conformance packs to enforce a security baseline across all accounts?
AWS Config conformance packs bundle multiple Config Rules and remediation actions into a single deployable unit. Deploy the AWS-provided 'Operational Best Practices for CIS AWS Foundations Benchmark' conformance pack to your entire organization via Organizations integration using a single CloudFormation StackSet: this applies all 29 CIS Level 1 controls across every current and future member account without configuring each account individually. Deploy via CLI: 'aws configservice put-organization-conformance-pack --organization-conformance-pack-name CIS-L1 --template-s3-uri s3://aws-configservice-us-east-1/conformance-packs/Operational-Best-Practices-for-CIS-AWS-v1.4-Level1.yaml'. Review compliance status at the organization level in the Config console under Conformance Packs. Non-compliant rules show which accounts and resources are failing: use this as your primary posture tracking view rather than per-account Security Hub dashboards when managing more than 10 accounts. Custom conformance packs let you bundle organization-specific rules alongside the AWS-managed rules into a single deployable package -- useful for enforcing tagging requirements or organization-specific encryption standards.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.