Skip to main content

Controls & frameworks

Frameworks​

Cloud Posture maps its controls to:

  • CIS AWS Foundations Benchmark v3.0
  • AWS Foundational Security Best Practices
  • OWASP Cloud-Native Top 10

The GCP pack mirrors the CIS Google Cloud Foundations control families, and Azure and the other providers follow the same control shape.

The control count is live

The number of controls grows as the catalogs do. The authoritative figures - total count, counts per category, per tier and per provider - come from GET /cloud-posture/rules (the Checks tab surfaces them). This page describes the shape of coverage rather than a number that will drift.

Categories​

Every control belongs to one of nine categories: identity, network, storage, database, logging, encryption, exposure, threat, lifecycle.

Across AWS the catalog spans IAM, S3, EC2 / security groups, RDS, EBS, KMS, CloudTrail, Config, GuardDuty, Security Hub, Inspector, Macie, CloudFront, ELB, Lambda, ECS, EKS, MSK, SQS, ECR, Secrets Manager, RAM, SSM, Route 53, Redshift, Backup and organization SCP guardrails - plus CIS Section 4 CloudWatch metric-filter alarms and lifecycle / EOL controls (deprecated Lambda runtimes, retired Fargate and Beanstalk platforms, databases past standard support).

Standard vs advanced tiers​

Controls come in two rigor tiers, chosen with the standard | advanced toggle at scan time:

  • Standard - the baseline CIS pack. A solid, low-noise assessment.
  • Advanced - strict, opt-in controls: granular public-ingress ports, public messaging surfaces, and proven-exposure escalation. In advanced mode, resource types apPosture could not read become fail-closed medium findings rather than silent passes - so a permissions gap can never hide a risk.

Strict public-ingress ports​

The advanced tier adds a control per sensitive port open to the internet - around 45 in all, from FTP / Telnet and SMB to database and cluster ports. The Docker daemon on 2375 is flagged critical ("unauthenticated → host takeover"). The baseline tier already covers the common admin / database ports (22, 3389, 3306, 5432, 6379, 27017, 9200).

Native detections​

Findings from the provider's own detectors - GuardDuty, Security Hub, Inspector, Access Analyzer, Macie - fold in and count toward severity, but they do not change the score denominator (they are detections, not control evaluations). Coverage gaps - resource types apPosture could not read - are surfaced honestly rather than scored as passes.

Scoring​

Score = passed ÷ assessed × 100, mapped to an A-F grade, where assessed excludes any control whose target resource type was absent from the snapshot. Every persisted finding carries a concrete remediation.