Lesson 7 of 7 · 8 min
Cloud security posture management: drift, IAM and exposed storage
Cloud environments change constantly, and not always through code. Learn what cloud security posture management does, why configuration drift happens, and how to find over-permissioned identities and exposed storage.
The previous lesson checked infrastructure before it was deployed. But cloud environments do not stay the way they were deployed. An engineer fixes an urgent problem in the console at night. A test bucket is made public “just for a minute”. A permission is added for a migration and never removed. New services appear through accounts nobody in security knows about. Each change may be small, but together they move the environment away from its intended, reviewed state.
What CSPM does
Cloud security posture management (CSPM) continuously inspects the configuration of cloud accounts through the providers’ own APIs and compares it with security rules and best-practice baselines. It answers questions such as: which storage is publicly reachable, which identities have far more permission than they use, which logs are switched off, and which resources are unencrypted. Cloud providers offer native services, such as AWS Security Hub, and many third-party tools do the same across several clouds.
| Common finding | Why it matters | Typical fix |
|---|---|---|
| Publicly accessible storage | Private files can be read by anyone who finds the address | Turn on account-wide public access blocking; grant access explicitly |
| Over-permissioned IAM roles and users | A stolen credential can do far more than the task needed | Remove unused permissions; prefer roles with short-lived credentials |
| Unused access keys and old accounts | Forgotten credentials are rarely watched | Disable, then delete after confirming |
| Audit logging disabled | Investigations have no evidence | Enable logging in every account and region, stored separately |
| Administrative ports open to the internet | Direct target for password guessing and exploits | Restrict to known addresses or use a bastion or managed access service |
Configuration drift
Drift is the gap between the configuration defined in code and what is actually running. It matters for two reasons. It can introduce risk, such as a manual change that opens access. And it undermines IaC itself: the next deployment may silently undo an emergency fix, or reviewers approve code that no longer reflects reality. IaC tools can detect drift by comparing their state with the live environment, and CSPM catches changes to resources that IaC does not manage at all. The goal is to route every change back through code, and to treat unexplained drift as a possible incident.
Over-permissioned identities
In the cloud, identity is the new perimeter: an attacker with the right credentials does not need to break anything. Permissions tend to grow and rarely shrink, so many identities accumulate rights they never use. Good practice is to grant the smallest set of permissions for a task, review usage data to remove what is not used, avoid long-lived access keys, and require multi-factor authentication for every human with console access.
Exposed storage
Public storage buckets are among the most common causes of cloud data exposure. Providers have responded with account-level safeguards: Amazon S3 Block Public Access, for instance, can override bucket and object settings that would otherwise make data public, and AWS enables it by default on new buckets. CSPM tools check that such safeguards stay switched on and flag any storage that is still reachable from the internet.
- Turn on CSPM or the provider’s native posture service in every account, including test accounts.
- Start from a recognised baseline, such as the CIS Foundations Benchmarks or CISA’s SCuBA baselines for cloud business applications.
- Assign each finding an owner and a deadline; posture findings nobody fixes are just noise.
- Fix the template, not only the live resource, so the problem does not come back.
Where FireAI fits
FireAI is not a CSPM tool and does not inspect cloud accounts. On the Mac, it covers the other end of the connection: the world map shows which cloud providers each app talks to, and Investigate notes when a connection goes to a cloud provider network, so you can tell whether it is a tool you expect.
Key takeaways
- CSPM continuously compares live cloud configuration with security rules and baselines.
- Drift is the gap between code and reality; route changes back through IaC and investigate unexplained drift.
- Over-permissioned identities and exposed storage are among the most common and damaging findings.
- Every finding needs an owner, and fixes belong in the template as well as the live resource.
Check yourself
1. What is configuration drift?
- A slow network connection
- The gap between the configuration defined in code and what is actually running — Right.
- A type of encryption
- Moving data between regions
Drift happens when live resources are changed outside the reviewed code.
2. How does CSPM mainly gather its information?
- By reading employees’ emails
- By querying the cloud providers’ configuration APIs — Right.
- By scanning the internet for open ports only
- By asking developers to fill in forms
CSPM reads configuration directly from the cloud accounts and compares it with rules.
3. Why is an unused but powerful IAM permission a risk?
- It costs money each month
- A stolen credential can use it, and unused rights are rarely monitored — Right.
- It slows down the console
- It breaks encryption
Attackers use whatever rights a stolen identity has. Removing unused permissions shrinks the damage.
Do it with FireAI
Put this lesson into practice on your own Mac.
- Rules: app, website, domain, IP or a range, forever or until you restart — Write a rule as precise as one address or as broad as an entire domain.
- Import and export your rules — Move your rules to a new Mac, or back them up, in a couple of clicks.
- How FireAI watches your Mac’s connections — Know which app is talking to the internet, in plain terms, without installing anything that runs as a hidden background service.
- Threat lists (opt-in) — Check your traffic against public threat data without sending it anywhere.
- The World map — See where your data actually goes, not just a hostname you’d have to look up yourself.
Sources
- AWS Security Hub: What is Security Hub?
- Amazon S3: Blocking public access to your storage
- CISA: Secure Cloud Business Applications (SCuBA)
- CIS Benchmarks
- NIST SP 800-137: Information Security Continuous Monitoring
- NIST SP 800-53 Rev. 5: Security and Privacy Controls
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.