Skip to main content

Cloud Posture (CSPM / CNAPP)

Path: /cloud-posture

Cloud Posture assesses a cloud account against curated control packs and folds the results into the same risk-weighted posture as everything else apPosture scans. It is agentless and read-only: it evaluates a resource snapshot - the JSON a viewer-role would get from describe / list calls - and never calls a mutating cloud API.

The design in one line​

Read-only snapshot in, evidence-based findings out - and a control that cannot see its target resource is reported N/A, never a pass and never a fail.

That last point is load-bearing: the score is passed ÷ assessed, and any control whose resource type is absent from the snapshot is excluded from the denominator. apPosture never over-claims a clean score, and never fabricates a failure it could not observe.

What you get​

  • A posture score (0-100) and A-F grade per account, with history.
  • Findings mapped to CIS and OWASP Cloud-Native controls, each with a concrete fix.
  • CIEM - IAM privilege-escalation paths.
  • Attack paths - toxic combinations that actually exist in the snapshot (internet → compute → IAM → account takeover, public data stores, subdomain takeover, and more).
  • Drift - what changed since the last scan, at the finding and the resource level.
  • A fleet overview rolling every account up into one estate view.

How a scan runs​

  1. Snapshot - collected agentlessly with read-only credentials, restored from a saved managed account, pasted in as describe-JSON, or a built-in demo snapshot.
  2. Evaluate - the provider's control catalog runs against the snapshot.
  3. Enrich - native detections (GuardDuty, Security Hub, Inspector, Access Analyzer, Macie) fold in, coverage gaps and toxic combinations are computed.
  4. Persist - failures land in the unified posture with drift recorded.

Live credentials passed to a one-off scan are used only for that scan and never persisted. Saved managed accounts store their secret Fernet-encrypted.

Next​

Related, but separate

Kubernetes Posture and DSPM data classification are adjacent features; this section is about cloud-provider control-plane posture.