[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF1MHDZW6XZTKYVSDZ9C6P":3,"skill-same:01M6AF1MHDZW6XZTKYVSDZ9C6P":139},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":77,"repositoryHtmlUrl":78,"repositoryHomepageUrl":79,"ownerHtmlUrl":80,"ownerBlogUrl":81,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M6AF1MHDZW6XZTKYVSDZ9C6P","implementing-cloud-security-posture-management",null,"Continuously monitor multi-cloud environments (AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Microsoft Defender for Cloud, and GCP Security Command Center. Use for cross-cloud posture monitoring, CIS\u002FSOC 2\u002FPCI DSS compliance, or drift-detection workflows; not for runtime workload protection or application security testing.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-security-posture-management\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"cloud","implementing cloud security posture management","cloud security","security","application security","cybersecurity","cspm","t1078","drift-detection","gcp","prowler","soc","cloud-security","testing","monitoring","pr","defender","workload","workflows","security command center","2026-11-10 10:12:30",false,"---\nname: implementing-cloud-security-posture-management\ndescription: 'Continuously monitor multi-cloud environments (AWS, Azure, GCP) for\n  misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite,\n  AWS Security Hub, Microsoft Defender for Cloud, and GCP Security Command Center.\n  Use for cross-cloud posture monitoring, CIS\u002FSOC 2\u002FPCI DSS compliance, or drift-detection\n  workflows; not for runtime workload protection or application security testing.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- cspm\n- multi-cloud\n- compliance\n- prowler\n- scoutsuite\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n---\n\n# Implementing Cloud Security Posture Management\n\n## When to Use\n\n- When establishing continuous security monitoring across AWS, Azure, and GCP environments\n- When compliance requirements demand automated posture assessment against CIS, SOC 2, or PCI DSS\n- When security teams need visibility into cloud misconfigurations across multiple accounts and subscriptions\n- When building a security operations workflow that detects and remediates drift from security baselines\n- When migrating workloads to the cloud and need to enforce security guardrails\n\n**Do not use** for runtime workload protection (use CWPP tools like Falco or Aqua), for application security testing (use DAST\u002FSAST tools), or for network intrusion detection (use cloud-native IDS like GuardDuty or Network Watcher).\n\n## Prerequisites\n\n- Multi-cloud credentials with read-only security audit permissions across all target environments\n- Prowler v3+ installed (`pip install prowler`)\n- ScoutSuite installed (`pip install scoutsuite`)\n- AWS Config, Azure Policy, and GCP Organization Policy enabled in respective environments\n- Central logging destination (S3 bucket, Log Analytics Workspace, or Cloud Storage) for findings aggregation\n- Notification channels configured (Slack, PagerDuty, email) for critical finding alerts\n\n## Workflow\n\n### Step 1: Deploy Cloud-Native CSPM Services\n\nEnable the built-in CSPM capabilities in each cloud provider for baseline posture assessment.\n\n```bash\n# AWS: Enable Security Hub with FSBP and CIS standards\naws securityhub enable-security-hub --enable-default-standards\naws securityhub batch-enable-standards --standards-subscription-requests \\\n  '[{\"StandardsArn\":\"arn:aws:securityhub:::standards\u002Fcis-aws-foundations-benchmark\u002Fv\u002F1.4.0\"}]'\n\n# Azure: Enable Microsoft Defender for Cloud (CSPM tier)\naz security pricing create --name CloudPosture --tier standard\naz security auto-provisioning-setting update --name default --auto-provision on\n\n# GCP: Enable Security Command Center Premium\ngcloud services enable securitycenter.googleapis.com\ngcloud scc settings update --organization=ORG_ID \\\n  --enable-asset-discovery\n```\n\n### Step 2: Run Prowler for Multi-Cloud Assessment\n\nExecute Prowler to perform comprehensive security checks across all three cloud providers.\n\n```bash\n# AWS assessment with all CIS checks\nprowler aws \\\n  --profile production \\\n  -M json-ocsf csv html \\\n  -o .\u002Fprowler-results\u002Faws\u002F \\\n  --compliance cis_1.4_aws cis_1.5_aws\n\n# Azure assessment\nprowler azure \\\n  --subscription-ids SUB_ID_1 SUB_ID_2 \\\n  -M json-ocsf csv html \\\n  -o .\u002Fprowler-results\u002Fazure\u002F \\\n  --compliance cis_2.0_azure\n\n# GCP assessment\nprowler gcp \\\n  --project-ids project-1 project-2 \\\n  -M json-ocsf csv html \\\n  -o .\u002Fprowler-results\u002Fgcp\u002F \\\n  --compliance cis_2.0_gcp\n\n# View summary across all providers\nprowler aws --list-compliance\n```\n\n### Step 3: Run ScoutSuite for Cross-Cloud Comparison\n\nUse ScoutSuite for a unified multi-cloud security assessment with visual reporting.\n\n```bash\n# Scan AWS\npython3 -m ScoutSuite aws --profile production \\\n  --report-dir .\u002Fscoutsuite\u002Faws\u002F\n\n# Scan Azure\npython3 -m ScoutSuite azure --cli \\\n  --all-subscriptions \\\n  --report-dir .\u002Fscoutsuite\u002Fazure\u002F\n\n# Scan GCP\npython3 -m ScoutSuite gcp --user-account \\\n  --all-projects \\\n  --report-dir .\u002Fscoutsuite\u002Fgcp\u002F\n\n# Each produces an HTML report with risk-scored findings\n```\n\n### Step 4: Build Automated Compliance Monitoring Pipeline\n\nCreate a scheduled pipeline that runs CSPM checks daily and routes findings to appropriate channels.\n\n```bash\n# Create a daily Prowler scan with EventBridge + CodeBuild (AWS)\ncat > buildspec.yml \u003C\u003C 'EOF'\nversion: 0.2\nphases:\n  install:\n    commands:\n      - pip install prowler\n  build:\n    commands:\n      - prowler aws -M json-ocsf -o s3:\u002F\u002Fsecurity-findings-bucket\u002Fprowler\u002F$(date +%Y%m%d)\u002F\n      - prowler aws --compliance cis_1.5_aws -M csv -o s3:\u002F\u002Fsecurity-findings-bucket\u002Fprowler\u002Fcompliance\u002F\n  post_build:\n    commands:\n      - |\n        CRITICAL=$(cat output\u002F*.json | grep -c '\"CRITICAL\"')\n        if [ \"$CRITICAL\" -gt 0 ]; then\n          aws sns publish --topic-arn arn:aws:sns:us-east-1:ACCOUNT:security-alerts \\\n            --subject \"Prowler: $CRITICAL critical findings\" \\\n            --message \"Review at s3:\u002F\u002Fsecurity-findings-bucket\u002Fprowler\u002F$(date +%Y%m%d)\u002F\"\n        fi\nEOF\n\n# Schedule with EventBridge\naws events put-rule \\\n  --name daily-prowler-scan \\\n  --schedule-expression \"cron(0 6 * * ? *)\" \\\n  --state ENABLED\n```\n\n### Step 5: Configure Finding Aggregation and Deduplication\n\nAggregate findings from multiple CSPM tools and cloud providers into a unified view.\n\n```python\n# findings_aggregator.py - Normalize and deduplicate CSPM findings\nimport json\nimport hashlib\nfrom datetime import datetime\n\ndef normalize_finding(finding, source):\n    \"\"\"Normalize findings from different CSPM tools to a common format.\"\"\"\n    normalized = {\n        'id': hashlib.sha256(f\"{finding.get('ResourceId','')}{finding.get('CheckId','')}\".encode()).hexdigest()[:16],\n        'source': source,\n        'cloud': finding.get('Provider', 'unknown'),\n        'account': finding.get('AccountId', finding.get('SubscriptionId', '')),\n        'region': finding.get('Region', ''),\n        'resource_type': finding.get('ResourceType', ''),\n        'resource_id': finding.get('ResourceId', ''),\n        'severity': finding.get('Severity', 'INFO').upper(),\n        'status': finding.get('Status', 'FAIL'),\n        'title': finding.get('CheckTitle', finding.get('Title', '')),\n        'description': finding.get('StatusExtended', ''),\n        'compliance': finding.get('Compliance', {}),\n        'remediation': finding.get('Remediation', {}).get('Recommendation', {}).get('Text', ''),\n        'timestamp': datetime.utcnow().isoformat()\n    }\n    return normalized\n\ndef aggregate_findings(prowler_file, scoutsuite_file):\n    findings = {}\n    for file_path, source in [(prowler_file, 'prowler'), (scoutsuite_file, 'scoutsuite')]:\n        with open(file_path) as f:\n            for line in f:\n                raw = json.loads(line)\n                normalized = normalize_finding(raw, source)\n                if normalized['status'] == 'FAIL':\n                    findings[normalized['id']] = normalized\n    return sorted(findings.values(), key=lambda x: {'CRITICAL':0,'HIGH':1,'MEDIUM':2,'LOW':3}.get(x['severity'],4))\n```\n\n### Step 6: Implement Drift Detection and Auto-Remediation\n\nSet up automated responses to configuration drift that violates security baselines.\n\n```bash\n# AWS Config auto-remediation for non-compliant S3 buckets\naws configservice put-remediation-configurations --remediation-configurations '[{\n  \"ConfigRuleName\": \"s3-bucket-public-read-prohibited\",\n  \"TargetType\": \"SSM_DOCUMENT\",\n  \"TargetId\": \"AWS-DisableS3BucketPublicReadWrite\",\n  \"Parameters\": {\n    \"S3BucketName\": {\"ResourceValue\": {\"Value\": \"RESOURCE_ID\"}}\n  },\n  \"Automatic\": true,\n  \"MaximumAutomaticAttempts\": 3,\n  \"RetryAttemptSeconds\": 60\n}]'\n\n# Azure Policy for auto-remediation\naz policy assignment create \\\n  --name \"enforce-storage-encryption\" \\\n  --policy \"\u002Fproviders\u002FMicrosoft.Authorization\u002FpolicyDefinitions\u002F404c3081-a854-4457-ae30-26a93ef643f9\" \\\n  --scope \"\u002Fsubscriptions\u002FSUB_ID\" \\\n  --enforcement-mode Default\n\n# GCP Organization Policy constraint\ngcloud resource-manager org-policies set-policy policy.yaml --organization=ORG_ID\n# policy.yaml: constraint: constraints\u002Fstorage.publicAccessPrevention, enforcement: true\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| CSPM | Cloud Security Posture Management, the practice of continuously monitoring cloud infrastructure for misconfigurations and compliance violations |\n| Configuration Drift | Unintended changes to cloud resource configurations that deviate from the approved security baseline over time |\n| Security Baseline | A documented set of minimum security configuration requirements that all cloud resources must meet |\n| Compliance Framework | A structured set of security controls and requirements (CIS, SOC 2, PCI DSS, NIST) against which cloud configurations are evaluated |\n| Finding Severity | Risk classification of a misconfiguration based on exploitability and potential impact (Critical, High, Medium, Low, Informational) |\n| Auto-Remediation | Automated corrective action that restores a non-compliant resource to its required configuration without manual intervention |\n\n## Tools & Systems\n\n- **Prowler**: Open-source multi-cloud security assessment tool with 300+ checks aligned to CIS, PCI DSS, HIPAA, and NIST\n- **ScoutSuite**: Multi-cloud security auditing tool producing risk-scored HTML reports from API-collected configuration data\n- **AWS Security Hub**: AWS-native CSPM with aggregated findings and compliance standard evaluation\n- **Microsoft Defender for Cloud**: Azure-native CSPM with secure score, regulatory compliance, and workload protection\n- **GCP Security Command Center**: GCP-native security platform with asset inventory, vulnerability scanning, and compliance monitoring\n\n## Common Scenarios\n\n### Scenario: Establishing CSPM for a Multi-Cloud Enterprise\n\n**Context**: An enterprise runs production workloads across AWS (primary), Azure (identity and Microsoft services), and GCP (data analytics). The security team needs unified posture visibility.\n\n**Approach**:\n1. Enable cloud-native CSPM in each provider: Security Hub, Defender for Cloud, SCC\n2. Deploy Prowler scans as daily scheduled jobs in each environment via CI\u002FCD pipelines\n3. Normalize and aggregate findings into a central data lake using the aggregation script\n4. Build dashboards in Grafana or Kibana showing posture scores by cloud, account, and severity\n5. Configure auto-remediation for known-good fixes (public access blocks, encryption enablement)\n6. Route CRITICAL findings to PagerDuty for immediate response and HIGH findings to Jira tickets\n7. Produce weekly compliance reports for executive stakeholders showing trend data\n\n**Pitfalls**: Running CSPM tools with overly broad permissions creates a high-value target. Use dedicated service accounts with read-only permissions and rotate credentials regularly. Different CSPM tools may report the same misconfiguration differently, so deduplication logic must account for varying resource ID formats and finding titles across tools.\n\n## Output Format\n\n```\nCloud Security Posture Management Dashboard\n==============================================\nOrganization: Acme Corp\nAssessment Date: 2026-02-23\nEnvironments: AWS (12 accounts), Azure (8 subscriptions), GCP (5 projects)\n\nPOSTURE SCORES:\n  AWS:   82\u002F100  (+3 from last week)\n  Azure: 76\u002F100  (-1 from last week)\n  GCP:   79\u002F100  (+5 from last week)\n  Overall: 79\u002F100\n\nFINDINGS BY SEVERITY:\n  Critical:  18 (AWS: 7, Azure: 8, GCP: 3)\n  High:      67 (AWS: 28, Azure: 24, GCP: 15)\n  Medium:   234 (AWS: 98, Azure: 87, GCP: 49)\n  Low:      412 (AWS: 178, Azure: 134, GCP: 100)\n\nTOP FAILING CATEGORIES:\n  1. IAM overly permissive policies     (43 findings)\n  2. Encryption not enabled at rest      (38 findings)\n  3. Public network exposure             (29 findings)\n  4. Logging and monitoring gaps         (24 findings)\n  5. Unused credentials and keys         (19 findings)\n\nAUTO-REMEDIATION (Last 7 Days):\n  Findings auto-remediated:  34\n  Manual remediation pending: 51\n  Exceptions approved:        8\n```\n","# Implementing Cloud Security Posture Management\n\n## When to Use\n\n- When establishing continuous security monitoring across AWS, Azure, and GCP environments\n- When compliance requirements demand automated posture assessment against CIS, SOC 2, or PCI DSS\n- When security teams need visibility into cloud misconfigurations across multiple accounts and subscriptions\n- When building a security operations workflow that detects and remediates drift from security baselines\n- When migrating workloads to the cloud and need to enforce security guardrails\n\n**Do not use** for runtime workload protection (use CWPP tools like Falco or Aqua), for application security testing (use DAST\u002FSAST tools), or for network intrusion detection (use cloud-native IDS like GuardDuty or Network Watcher).\n\n## Prerequisites\n\n- Multi-cloud credentials with read-only security audit permissions across all target environments\n- Prowler v3+ installed (`pip install prowler`)\n- ScoutSuite installed (`pip install scoutsuite`)\n- AWS Config, Azure Policy, and GCP Organization Policy enabled in respective environments\n- Central logging destination (S3 bucket, Log Analytics Workspace, or Cloud Storage) for findings aggregation\n- Notification channels configured (Slack, PagerDuty, email) for critical finding alerts\n\n## Workflow\n\n### Step 1: Deploy Cloud-Native CSPM Services\n\nEnable the built-in CSPM capabilities in each cloud provider for baseline posture assessment.\n\n```bash\n# AWS: Enable Security Hub with FSBP and CIS standards\naws securityhub enable-security-hub --enable-default-standards\naws securityhub batch-enable-standards --standards-subscription-requests \\\n  '[{\"StandardsArn\":\"arn:aws:securityhub:::standards\u002Fcis-aws-foundations-benchmark\u002Fv\u002F1.4.0\"}]'\n\n# Azure: Enable Microsoft Defender for Cloud (CSPM tier)\naz security pricing create --name CloudPosture --tier standard\naz security auto-provisioning-setting update --name default --auto-provision on\n\n# GCP: Enable Security Command Center Premium\ngcloud services enable securitycenter.googleapis.com\ngcloud scc settings update --organization=ORG_ID \\\n  --enable-asset-discovery\n```\n\n### Step 2: Run Prowler for Multi-Cloud Assessment\n\nExecute Prowler to perform comprehensive security checks across all three cloud providers.\n\n```bash\n# AWS assessment with all CIS checks\nprowler aws \\\n  --profile production \\\n  -M json-ocsf csv html \\\n  -o .\u002Fprowler-results\u002Faws\u002F \\\n  --compliance cis_1.4_aws cis_1.5_aws\n\n# Azure assessment\nprowler azure \\\n  --subscription-ids SUB_ID_1 SUB_ID_2 \\\n  -M json-ocsf csv html \\\n  -o .\u002Fprowler-results\u002Fazure\u002F \\\n  --compliance cis_2.0_azure\n\n# GCP assessment\nprowler gcp \\\n  --project-ids project-1 project-2 \\\n  -M json-ocsf csv html \\\n  -o .\u002Fprowler-results\u002Fgcp\u002F \\\n  --compliance cis_2.0_gcp\n\n# View summary across all providers\nprowler aws --list-compliance\n```\n\n### Step 3: Run ScoutSuite for Cross-Cloud Comparison\n\nUse ScoutSuite for a unified multi-cloud security assessment with visual reporting.\n\n```bash\n# Scan AWS\npython3 -m ScoutSuite aws --profile production \\\n  --report-dir .\u002Fscoutsuite\u002Faws\u002F\n\n# Scan Azure\npython3 -m ScoutSuite azure --cli \\\n  --all-subscriptions \\\n  --report-dir .\u002Fscoutsuite\u002Fazure\u002F\n\n# Scan GCP\npython3 -m ScoutSuite gcp --user-account \\\n  --all-projects \\\n  --report-dir .\u002Fscoutsuite\u002Fgcp\u002F\n\n# Each produces an HTML report with risk-scored findings\n```\n\n### Step 4: Build Automated Compliance Monitoring Pipeline\n\nCreate a scheduled pipeline that runs CSPM checks daily and routes findings to appropriate channels.\n\n```bash\n# Create a daily Prowler scan with EventBridge + CodeBuild (AWS)\ncat > buildspec.yml \u003C\u003C 'EOF'\nversion: 0.2\nphases:\n  install:\n    commands:\n      - pip install prowler\n  build:\n    commands:\n      - prowler aws -M json-ocsf -o s3:\u002F\u002Fsecurity-findings-bucket\u002Fprowler\u002F$(date +%Y%m%d)\u002F\n      - prowler aws --compliance cis_1.5_aws -M csv -o s3:\u002F\u002Fsecurity-findings-bucket\u002Fprowler\u002Fcompliance\u002F\n  post_build:\n    commands:\n      - |\n        CRITICAL=$(cat output\u002F*.json | grep -c '\"CRITICAL\"')\n        if [ \"$CRITICAL\" -gt 0 ]; then\n          aws sns publish --topic-arn arn:aws:sns:us-east-1:ACCOUNT:security-alerts \\\n            --subject \"Prowler: $CRITICAL critical findings\" \\\n            --message \"Review at s3:\u002F\u002Fsecurity-findings-bucket\u002Fprowler\u002F$(date +%Y%m%d)\u002F\"\n        fi\nEOF\n\n# Schedule with EventBridge\naws events put-rule \\\n  --name daily-prowler-scan \\\n  --schedule-expression \"cron(0 6 * * ? *)\" \\\n  --state ENABLED\n```\n\n### Step 5: Configure Finding Aggregation and Deduplication\n\nAggregate findings from multiple CSPM tools and cloud providers into a unified view.\n\n```python\n# findings_aggregator.py - Normalize and deduplicate CSPM findings\nimport json\nimport hashlib\nfrom datetime import datetime\n\ndef normalize_finding(finding, source):\n    \"\"\"Normalize findings from different CSPM tools to a common format.\"\"\"\n    normalized = {\n        'id': hashlib.sha256(f\"{finding.get('ResourceId','')}{finding.get('CheckId','')}\".encode()).hexdigest()[:16],\n        'source': source,\n        'cloud': finding.get('Provider', 'unknown'),\n        'account': finding.get('AccountId', finding.get('SubscriptionId', '')),\n        'region': finding.get('Region', ''),\n        'resource_type': finding.get('ResourceType', ''),\n        'resource_id': finding.get('ResourceId', ''),\n        'severity': finding.get('Severity', 'INFO').upper(),\n        'status': finding.get('Status', 'FAIL'),\n        'title': finding.get('CheckTitle', finding.get('Title', '')),\n        'description': finding.get('StatusExtended', ''),\n        'compliance': finding.get('Compliance', {}),\n        'remediation': finding.get('Remediation', {}).get('Recommendation', {}).get('Text', ''),\n        'timestamp': datetime.utcnow().isoformat()\n    }\n    return normalized\n\ndef aggregate_findings(prowler_file, scoutsuite_file):\n    findings = {}\n    for file_path, source in [(prowler_file, 'prowler'), (scoutsuite_file, 'scoutsuite')]:\n        with open(file_path) as f:\n            for line in f:\n                raw = json.loads(line)\n                normalized = normalize_finding(raw, source)\n                if normalized['status'] == 'FAIL':\n                    findings[normalized['id']] = normalized\n    return sorted(findings.values(), key=lambda x: {'CRITICAL':0,'HIGH':1,'MEDIUM':2,'LOW':3}.get(x['severity'],4))\n```\n\n### Step 6: Implement Drift Detection and Auto-Remediation\n\nSet up automated responses to configuration drift that violates security baselines.\n\n```bash\n# AWS Config auto-remediation for non-compliant S3 buckets\naws configservice put-remediation-configurations --remediation-configurations '[{\n  \"ConfigRuleName\": \"s3-bucket-public-read-prohibited\",\n  \"TargetType\": \"SSM_DOCUMENT\",\n  \"TargetId\": \"AWS-DisableS3BucketPublicReadWrite\",\n  \"Parameters\": {\n    \"S3BucketName\": {\"ResourceValue\": {\"Value\": \"RESOURCE_ID\"}}\n  },\n  \"Automatic\": true,\n  \"MaximumAutomaticAttempts\": 3,\n  \"RetryAttemptSeconds\": 60\n}]'\n\n# Azure Policy for auto-remediation\naz policy assignment create \\\n  --name \"enforce-storage-encryption\" \\\n  --policy \"\u002Fproviders\u002FMicrosoft.Authorization\u002FpolicyDefinitions\u002F404c3081-a854-4457-ae30-26a93ef643f9\" \\\n  --scope \"\u002Fsubscriptions\u002FSUB_ID\" \\\n  --enforcement-mode Default\n\n# GCP Organization Policy constraint\ngcloud resource-manager org-policies set-policy policy.yaml --organization=ORG_ID\n# policy.yaml: constraint: constraints\u002Fstorage.publicAccessPrevention, enforcement: true\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| CSPM | Cloud Security Posture Management, the practice of continuously monitoring cloud infrastructure for misconfigurations and compliance violations |\n| Configuration Drift | Unintended changes to cloud resource configurations that deviate from the approved security baseline over time |\n| Security Baseline | A documented set of minimum security configuration requirements that all cloud resources must meet |\n| Compliance Framework | A structured set of security controls and requirements (CIS, SOC 2, PCI DSS, NIST) against which cloud configurations are evaluated |\n| Finding Severity | Risk classification of a misconfiguration based on exploitability and potential impact (Critical, High, Medium, Low, Informational) |\n| Auto-Remediation | Automated corrective action that restores a non-compliant resource to its required configuration without manual intervention |\n\n## Tools & Systems\n\n- **Prowler**: Open-source multi-cloud security assessment tool with 300+ checks aligned to CIS, PCI DSS, HIPAA, and NIST\n- **ScoutSuite**: Multi-cloud security auditing tool producing risk-scored HTML reports from API-collected configuration data\n- **AWS Security Hub**: AWS-native CSPM with aggregated findings and compliance standard evaluation\n- **Microsoft Defender for Cloud**: Azure-native CSPM with secure score, regulatory compliance, and workload protection\n- **GCP Security Command Center**: GCP-native security platform with asset inventory, vulnerability scanning, and compliance monitoring\n\n## Common Scenarios\n\n### Scenario: Establishing CSPM for a Multi-Cloud Enterprise\n\n**Context**: An enterprise runs production workloads across AWS (primary), Azure (identity and Microsoft services), and GCP (data analytics). The security team needs unified posture visibility.\n\n**Approach**:\n1. Enable cloud-native CSPM in each provider: Security Hub, Defender for Cloud, SCC\n2. Deploy Prowler scans as daily scheduled jobs in each environment via CI\u002FCD pipelines\n3. Normalize and aggregate findings into a central data lake using the aggregation script\n4. Build dashboards in Grafana or Kibana showing posture scores by cloud, account, and severity\n5. Configure auto-remediation for known-good fixes (public access blocks, encryption enablement)\n6. Route CRITICAL findings to PagerDuty for immediate response and HIGH findings to Jira tickets\n7. Produce weekly compliance reports for executive stakeholders showing trend data\n\n**Pitfalls**: Running CSPM tools with overly broad permissions creates a high-value target. Use dedicated service accounts with read-only permissions and rotate credentials regularly. Different CSPM tools may report the same misconfiguration differently, so deduplication logic must account for varying resource ID formats and finding titles across tools.\n\n## Output Format\n\n```\nCloud Security Posture Management Dashboard\n==============================================\nOrganization: Acme Corp\nAssessment Date: 2026-02-23\nEnvironments: AWS (12 accounts), Azure (8 subscriptions), GCP (5 projects)\n\nPOSTURE SCORES:\n  AWS:   82\u002F100  (+3 from last week)\n  Azure: 76\u002F100  (-1 from last week)\n  GCP:   79\u002F100  (+5 from last week)\n  Overall: 79\u002F100\n\nFINDINGS BY SEVERITY:\n  Critical:  18 (AWS: 7, Azure: 8, GCP: 3)\n  High:      67 (AWS: 28, Azure: 24, GCP: 15)\n  Medium:   234 (AWS: 98, Azure: 87, GCP: 49)\n  Low:      412 (AWS: 178, Azure: 134, GCP: 100)\n\nTOP FAILING CATEGORIES:\n  1. IAM overly permissive policies     (43 findings)\n  2. Encryption not enabled at rest      (38 findings)\n  3. Public network exposure             (29 findings)\n  4. Logging and monitoring gaps         (24 findings)\n  5. Unused credentials and keys         (19 findings)\n\nAUTO-REMEDIATION (Last 7 Days):\n  Findings auto-remediated:  34\n  Manual remediation pending: 51\n  Exceptions approved:        8\n```\n",{"name":5,"tags":57,"author":61,"domain":37,"license":15,"version":62,"nist_csf":63,"subdomain":44,"description":68,"mitre_attack":69},[44,38,58,59,42,60],"multi-cloud","compliance","scoutsuite","mahipal","1.0",[64,65,66,67],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Continuously monitor multi-cloud environments (AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Microsoft Defender for Cloud, and GCP Security Command Center. Use for cross-cloud posture monitoring, CIS\u002FSOC 2\u002FPCI DSS compliance, or drift-detection workflows; not for runtime workload protection or application security testing.\n",[70,71,72,73],"T1078.004","T1530","T1537","T1580","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-cloud-security-posture-management",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-security-posture-management",{"tool":90,"command":91},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-security-posture-management",{"tool":93,"command":94},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-security-posture-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-security-posture-management\u002FSKILL.md",true,[98,103,109,113,117,121,127,131,135],{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-security-posture-management\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",1946,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-security-posture-management\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Farchitecture_decision_records.md",8716,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fc-level-advisor\u002Fcto-advisor\u002Freferences\u002Farchitecture_decision_records.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fengineering_metrics.md",12365,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fc-level-advisor\u002Fcto-advisor\u002Freferences\u002Fengineering_metrics.md",{"path":118,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Ftechnology_evaluation_framework.md",9875,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fc-level-advisor\u002Fcto-advisor\u002Freferences\u002Ftechnology_evaluation_framework.md",{"path":122,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fagent.py","SCRIPT","脚本",7831,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-security-posture-management\u002Fscripts\u002Fagent.py",{"path":128,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":129,"sourceHtmlUrl":130},"scripts\u002Fteam_scaling_calculator.py",19950,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fc-level-advisor\u002Fcto-advisor\u002Fscripts\u002Fteam_scaling_calculator.py",{"path":132,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":133,"sourceHtmlUrl":134},"scripts\u002Ftech_debt_analyzer.py",17297,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fc-level-advisor\u002Fcto-advisor\u002Fscripts\u002Ftech_debt_analyzer.py",{"path":136,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":137,"sourceHtmlUrl":138},"SKILL.es.md",12963,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-security-posture-management\u002FSKILL.es.md",[140,165,189,212,238,265],{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[146],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[148,149,150,151,35,37,152,153,47,154,155,156,157,158,159,160,161,162,163,164],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[171],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[173,161,174,175,35,176,37,47,177,178,179,180,181,182,183,184,185,186,187,188],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":197,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[195,196],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[183,198,199,200,45,37,201,202,177,59,203,204,205,206,207,39,208,209,210,211],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[218],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,37,223,224,225,226,227,228,229,230,231,232,233,234,180,235,236,237],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[244],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[246,247,248,37,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":266,"name":267,"nameZh":6,"description":268,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":269,"categories":270,"keywords":272,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[271],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[35,273,37,274,275,276,43,277,278,279,280,39,281,208,282,283,284,285,286,287],"triaging security incident","siem","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]