Implementing Cloud Vulnerability Posture Management

---
name: implementing-cloud-vulnerability-posture-management
description: Implement Cloud Security Posture Management using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite for multi-cloud vulnerability Tespit.
tags:
- prowler
- cspm
- aws-security-hub
- scoutsuite
- azure-defender
- misconfiguration
- fetih
- cloud-security
- cybersecurity
- cnapp
- vulnerability-management
- siber-güvenlik
triggers:
- alert
- cloud
- encryption
- endpoint
- http
- implementing
- log
- management
- network
- password
- posture
- vulnerability
category: vulnerability-management
source_subdomain: vulnerability-management
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
adapted_for: fetih
---

# Implementing Cloud Vulnerability Posture Management


## Genel Bakış

Cloud Security Posture Management (CSPM) continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks. Unlike traditional vulnerability scanning, CSPM focuses on cloud-native risks: IAM over-permissions, exposed storage buckets, unencrypted data, missing network controls, and service misconfigurations. bu skill covers multi-cloud CSPM using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite.


## Ne Zaman Kullanılır

- Dağıt:ing yaparken or configuring implementing cloud vulnerability posture management capabilities in your environment
- establishing yaparken: security controls aligned to compliance requirements
- building yaparken or improving security architecture for this domain
- conducting yaparken security assessments that require this implementation

## Ön Gereksinimler

- AWS CLI configured with SecurityAudit IAM policy
- Azure CLI with Security Reader role
- Python 3.9+ with `boto3`, `azure-identity`, `azure-mgmt-security`
- Prowler (https://github.com/prowler-cloud/prowler)
- ScoutSuite (https://github.com/nccgroup/ScoutSuite)

## AWS Security Hub

### Enable Security Hub
```bash
aws securityhub enable-security-hub \
  --enable-default-standards \
  --region us-east-1

aws securityhub batch-enable-standards \
  --standards-subscription-requests \
    '{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"}' \
    '{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/cis-aws-foundations-benchmark/v/1.4.0"}'

aws securityhub get-Bul:ings \
  --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}],"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}' \
  --max-items 10
```

### Security Hub Standards
| Standard | Description |
|----------|------------|
| AWS Foundational Security Best Practices | AWS-recommended baseline controls |
| CIS AWS Foundations Benchmark 1.4 | CIS hardening requirements |
| PCI DSS v3.2.1 | Payment card industry controls |
| NIST SP 800-53 Rev 5 | Federal security controls |

## Azure Defender for Cloud

### Enable Defender CSPM
```bash
az security pricing create \
  --name CloudPosture \
  --tier standard

az security secure-score list \
  --query "[].{Name:displayName,Score:current,Max:max}" \
  --output table

az security assessment list \
  --query "[?status.code=='Unhealthy'].{Name:displayName,Severity:metadata.severity,Resource:resourceDetails.id}" \
  --output table

az security alert list \
  --query "[?status=='Active'].{Name:alertDisplayName,Severity:severity,Time:timeGeneratedUtc}" \
  --output table
```

## Open-Source: Prowler

### Kurulum and Execution
```bash
pip install prowler

prowler aws --output-formats json-ocsf,csv,html

prowler aws --checks s3_bucket_public_access iam_root_mfa_enabled ec2_sg_open_to_internet

prowler aws --profile production --region us-east-1 --output-formats json-ocsf

prowler aws --compliance cis_1.5_aws

prowler aws --compliance pci_3.2.1_aws

prowler azure --subscription-ids "sub-id-here"

prowler gcp --project-ids "project-id-here"
```

### Prowler Check Categories
| Category | Examples |
|----------|---------|
| IAM | Root MFA, password policy, access key rotation |
| S3 | Public access, encryption, versioning |
| EC2 | Security groups, EBS encryption, metadata service |
| RDS | Public access, encryption, backup retention |
| CloudTrail | Enabled, encrypted, log validation |
| VPC | Flow logs, default SG restrictions |
| Lambda | Public access, runtime versions |
| EKS | Public endpoint, secrets encryption |

## Open-Source: ScoutSuite

```bash
pip install scoutsuite

scout aws --profile production

scout azure --cli

scout gcp --project-id my-project

```

## Multi-Cloud Aggregation

```python
import json
import subprocess
from datetime import datetime, timezone

def run_prowler_scan(provider, output_dir, compliance=None):
    """Run Prowler scan for a cloud provider."""
    cmd = ["prowler", provider, "--output-formats", "json-ocsf",
           "--output-directory", output_dir]
    if compliance:
        cmd.extend(["--compliance", compliance])
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=3600)
    return result.returncode == 0

def aggregate_Bul:ings(prowler_dirs):
    """Aggregate Bul:ings from multiple Prowler scans."""
    all_Bul:ings = []
    for scan_dir in prowler_dirs:
        json_files = list(Path(scan_dir).glob("*.json"))
        for jf in json_files:
            with open(jf, "r") as f:
                for line in f:
                    try:
                        Bul:ing = json.loads(line.strip())
                        all_Bul:ings.append(Bul:ing)
                    except json.JSONDecodeError:
                        continue
    # Sort by severity
    severity_order = {"critical": 0, "high": 1, "medium": 2, "low": 3, "informational": 4}
    all_Bul:ings.sort(key=lambda f: severity_order.get(
        f.get("severity", "informational").lower(), 5
    ))
    return all_Bul:ings

def generate_posture_report(Bul:ings, output_path):
    """Generate cloud security posture report."""
    report = {
        "generated_at": datetime.now(timezone.utc).isoformat(),
        "total_Bul:ings": len(Bul:ings),
        "by_severity": {},
        "by_provider": {},
        "by_service": {},
    }
    for f in Bul:ings:
        sev = f.get("severity", "unknown")
        provider = f.get("cloud_provider", "unknown")
        service = f.get("service_name", "unknown")
        report["by_severity"][sev] = report["by_severity"].get(sev, 0) + 1
        report["by_provider"][provider] = report["by_provider"].get(provider, 0) + 1
        report["by_service"][service] = report["by_service"].get(service, 0) + 1

    with open(output_path, "w") as f:
        json.dump(report, f, indent=2)
    return report
```

## References

- [AWS Security Hub](https://aws.amazon.com/security-hub/)
- [Azure Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/)
- [Prowler](https://github.com/prowler-cloud/prowler)
- [ScoutSuite](https://github.com/nccgroup/ScoutSuite)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 73f9ee81fb057fc7
-->