RedStrikeby Encyfr

Cloud Security

Cloud Security (CSPM)

Connect AWS, Azure, and GCP to continuously assess cloud posture with Prowler-based CSPM checks aligned to CIS benchmarks.

2 min read

RedStrike's Cloud Security Posture Management (CSPM) continuously evaluates your cloud accounts against hundreds of controls using Prowler, mapping every finding to CIS benchmarks and common compliance frameworks.

TL;DR

Connect AWS, Azure, or GCP with a read-only role, and RedStrike runs Prowler on a schedule to detect misconfigurations — public storage, weak IAM, unencrypted data, disabled logging — mapped to CIS, SOC 2, and PCI DSS. Access is read-only.

What CSPM checks

Prowler evaluates configuration across services and returns pass/fail per control. Representative categories:

DomainExample checks
IdentityRoot MFA, over-privileged roles, unused keys
StoragePublic buckets, missing encryption, no versioning
NetworkOpen security groups, unrestricted SSH/RDP
LoggingCloudTrail/Activity logs disabled, no retention
DataUnencrypted volumes, databases, and snapshots

Connect a cloud account

RedStrike uses read-only access. It never has permission to modify or delete your resources.

AWS

Create an IAM role that trusts RedStrike and attach the AWS-managed SecurityAudit policy:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::REDSTRIKE_ACCOUNT:root" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "YOUR_EXTERNAL_ID" } }
  }]
}

Paste the role ARN and external ID into Targets → Add cloud account → AWS.

Azure

Register RedStrike as a service principal and grant the Reader and Security Reader roles at the subscription scope:

az ad sp create-for-rbac --name redstrike-cspm \
  --role "Security Reader" --scopes /subscriptions/SUB_ID

Provide the tenant ID, client ID, client secret, and subscription ID.

GCP

Create a service account with the Security Reviewer and Viewer roles, then upload its JSON key:

gcloud iam service-accounts create redstrike-cspm
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:redstrike-cspm@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Grant only read-only roles. RedStrike does not require write access, and you should not give it any. Rotate credentials on a regular schedule.

Schedule and scope

Cloud scans run on the same scheduler as other scans — nightly is common for posture drift. You can scope by account, subscription, project, or region to keep runs focused and fast.

Reading cloud findings

Cloud findings behave like any other finding: severity, status, evidence (the exact resource and misconfigured setting), and remediation. Each is tagged with the CIS control and mapped frameworks so compliance owners can filter by requirement. See Reports & Evidence to export them.

Next