Cloud Security Posture Management

# =============================================
+# AWS Cloud Security Hardening
+# =============================================

+# 1. Enable Security Hub
+aws securityhub enable-security-hub --enable-default-standards

+# 2. Enable Config recorder
+aws configservice put-configuration-recorder \
+  --configuration-recorder name=default,roleArn=arn:aws:iam::role/awsconfig

+# 3. S3 public access block
+aws s3api put-public-access-block \
+  --bucket my-bucket \
+  --public-access-block-configuration \
+  "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

+# 4. Enable GuardDuty
+aws guardduty create-detector --enable

+# 5. Check overly permissive IAM
+aws iam get-account-authorization-details | \
+  python3 -c "
+import json,sys
+data=json.load(sys.stdin)
+for p in data.get('UserDetailList',[]):
+    for policy in p.get('UserPolicyList',[]):
+        for stmt in policy.get('PolicyDocument',{}).get('Statement',[]):
+            if stmt.get('Effect')=='Allow' and stmt.get('Resource')=='*':
+                print(f'WARNING: {p["UserName"]} has * resource')
+"

# =============================================
+# Azure Security Configuration
+# =============================================

+# 1. Enable Defender for Cloud
+az security auto-provisioning-setting update --name default --autoProvision On

+# 2. NSG audit — check 0.0.0.0/0
+az network nsg list --query "[].securityRules[?access=='Allow' && direction=='Inbound' && sourceAddressPrefix=='*']"

+# 3. Enable Azure Policy
+az policy assignment create \
+  --policy "Audit VMs that do not use managed disks"

# =============================================
+# GCP Security Posture Management
+# =============================================

+# 1. Enable Security Command Center
+gcloud scc sources enable --organization=ORG_ID --source=SOURCE_ID

+# 2. Audit logging
+gcloud logging sinks create audit-sink \
+  --destination=storage.googleapis.com/audit-bucket \
+  --log-filter="logName:cloudaudit.googleapis.com"

+# 3. Check public GCS buckets
+gsutil iam get gs://my-bucket | grep allUsers

+# 4. Firewall audit
+gcloud compute firewall-rules list \
+  --filter="sourceRanges=0.0.0.0/0 AND allowed.ports=22"

# =============================================
+# IaC Security Scanning
+# =============================================

+# 1. Checkov — Terraform/CloudFormation
+checkov -d ./terraform/
+
+# 2. tfsec
+tfsec ./terraform/
+
+# 3. Terrascan
+terrascan scan -d ./terraform/ -i terraform
+
+# 4. cfn-lint
+cfn-lint template.yaml
+
+# 5. Semgrep IaC rules
+semgrep --config=p/terraform ./terraform/

# =============================================
+# CSPM Tools — Open Source
+# =============================================

+# 1. Prowler — AWS security
+pip install prowler
+prowler aws --checks cis_level2

+# 2. ScoutSuite — Multi-cloud
+pip install scoutsuite
+scout aws

+# 3. Steampipe — SQL queries
+steampipe plugin install aws
+steampipe query "SELECT name FROM aws_s3_bucket WHERE bucket_policy_is_public"

# =============================================
+# Cloud IAM Security Audit
+# =============================================

+# AWS: Find users with admin access
+aws iam list-entities-for-policy \
+  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

+# AWS: Find unused IAM credentials
+aws iam generate-credential-report
+aws iam get-credential-report \
+  --query 'Content' --output text | base64 -d

+# AWS: Find roles that can be assumed externally
+aws iam list-roles --query 'Roles[?contains(AssumeRolePolicyDocument.Statement[].Principal.AWS, `*`)]'

+# Azure: Find owners on subscriptions
+az role assignment list --role "Owner" \
+  --query "[].{Principal:principalName, Scope:scope}"

+# GCP: Find service accounts with keys
+gcloud iam service-accounts list \
+  --format="table(email,displayName)"
+gcloud iam service-accounts keys list \
+  --iam-account=SA_EMAIL

+# Terraform: Check for overly permissive policies
+cat > check_iam.py << 'EOF'
+import json, glob
+for f in glob.glob("**/*.tf.json", recursive=True):
+    data = json.load(open(f))
+    for r in data.get("resource", []):
+        for policy in r.get("aws_iam_policy", {}):
+            doc = json.loads(policy["policy"])
+            for stmt in doc.get("Statement", []):
+                if stmt.get("Effect") == "Allow":
+                    actions = stmt.get("Action", [])
+                    if isinstance(actions, str):
+                        actions = [actions]
+                    if "*" in actions:
+                        print(f"WARNING: {policy} has Action: *")
+EOF
+python3 check_iam.py

# =============================================
+# Cloud Logging Best Practices
+# =============================================

+# AWS CloudTrail — Log semua API calls
+aws cloudtrail create-trail \
+  --name org-trail \
+  --s3-bucket-name audit-logs-bucket \
+  --is-multi-region-trail \
+  --enable-log-file-validation

+aws cloudtrail start-logging --name org-trail

+# AWS VPC Flow Logs — Network traffic
+aws ec2 create-flow-logs \
+  --resource-type VPC \
+  --resource-ids vpc-12345 \
+  --traffic-type ALL \
+  --log-destination-type s3 \
+  --log-destination arn:aws:s3:::flow-logs-bucket

+# Azure Monitor — Activity logs
+az monitor diagnostic-settings create \
+  --name audit \
+  --resource /subscriptions/xxx \
+  --storage-account auditstorage \
+  --logs '[
+    {"category":"Administrative","enabled":true},
+    {"category":"Security","enabled":true},
+    {"category":"Alert","enabled":true}
+  ]'

+# GCP Audit Logs
+gcloud logging sinks create audit-sink \
+  --log-filter='logName:cloudaudit.googleapis.com' \
+  --destination=storage.googleapis.com/audit-bucket

# =============================================
+# Cloud Incident Response — Quick Actions
+# =============================================

+# COMPROMISED EC2 INSTANCE
+# 1. Snapshot instance (preserve evidence)
+aws ec2 create-snapshot --volume-id vol-xxx \
+  --description "IR evidence - $(date)"

+# 2. Isolate instance (change security group)
+aws ec2 modify-instance-attribute \
+  --instance-id i-xxx \
+  --groups sg-isolation  # SG with no rules

+# 3. Capture instance metadata
+aws ec2 describe-instances --instance-id i-xxx

+# COMPROMISED IAM CREDENTIALS
+# 1. Immediately disable access
+aws iam update-access-key \
+  --user-name compromised-user \
+  --access-key-id AKIAxxx \
+  --status Inactive

+# 2. Revoke all sessions
+aws iam put-user-policy \
+  --user-name compromised-user \
+  --policy-name RevokeAllSessions \
+  --policy-document '{
+    "Version":"2012-10-17",
+    "Statement":[{
+      "Effect":"Deny",
+      "Action":"*",
+      "Resource":"*",
+      "Condition":{"DateLessThan":{"aws:TokenIssueTime":"2024-01-15T00:00:00Z"}}
+    }]
+  }'

+# 3. Check CloudTrail for damage
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \
+  --max-results 100

# =============================================
+# Cloud Cost Anomaly Detection
+# =============================================

+# AWS — Check billing anomaly
+aws ce get-cost-and-usage \
+  --time-period Start=2024-01-01,End=2024-01-15 \
+  --granularity DAILY \
+  --metrics "UnblendedCost"

+# AWS — Set billing alarm
+aws cloudwatch put-metric-alarm \
+  --alarm-name "HighBilling" \
+  --metric-name EstimatedCharges \
+  --namespace AWS/Billing \
+  --threshold 1000 \
+  --comparison-operator GreaterThanThreshold \
+  --evaluation-periods 1 \
+  --statistic Maximum

+# Check for crypto mining indicators
+# - Unusual GPU instance launches
+# - High CPU utilization on small instances
+# - New instances in unexpected regions
+aws ec2 describe-instances \
+  --filters "Name=instance-type,Values=g4dn.*,p3.*" \
+  --query "Reservations[].Instances[].[InstanceId,LaunchTime,Tags[?Key=='Name'].Value]"

+# Azure — Cost anomaly
+az costmanagement query \
+  --type ActualCost \
+  --timeframe MonthToDate \
+  --dataset-aggregation '{"totalCost":{"name":"Cost","function":"Sum"}}'