Skip to main content

Remediation & drift

Remediation as code​

Every persisted cloud finding carries a fix. Where apPosture is confident, that fix is a concrete, copy-pasteable one-liner with the resource already interpolated - an AWS CLI, gcloud or gsutil command that closes the specific gap. Where no confident one-liner exists, the finding still carries text remediation guidance.

Config drift​

Cloud Posture tracks change on two levels, so "what moved since last time?" is always answerable:

  • Finding-level drift - each scan reports which findings are new, resolved or unchanged relative to the previous run.
  • Resource-level config drift - a compact security-state signature is stored per resource and diffed on the next scan. It watches the attributes that matter: an S3 bucket turning public or losing encryption, a security group opening a CIDR or a port, an instance losing IMDSv2 or gaining a public IP, a role gaining a path to admin or a wildcard trust, a Lambda going public, a KMS key losing rotation, a snapshot turning public, and more.

Risk-increasing flips are raised as high; a resource born public is elevated; positive changes are recorded as info. The result is an audit trail of how an account's security state is trending, not just a point-in-time score.

Continuous posture​

Saved managed accounts are re-scanned automatically once they age past a threshold, so the estate view stays current without anyone pressing a button. Coverage gaps - resource types apPosture could not read - are surfaced on every run (and become fail-closed findings in the advanced tier), so a shrinking permission set can never quietly turn into a rising score.

See also: Controls & frameworks for the standard vs advanced tiers, and CIEM & attack paths.