CSPM tools continuously scan cloud‑provider APIs, configuration states, and runtime metadata to detect drift from defined security baselines across AWS, Azure, and GCP. They automate remediation via IaC hooks, policy‑as‑code engines, and alerting pipelines, keeping the posture aligned in near‑real time.
How a CSPM works – step‑by‑step
1. Credential ingestion – Use service‑account keys or assume‑role ARNs (e.g., aws sts assume-role --role-arn arn:aws:iam::123456789012:role/CSPMReadOnly).
2. Asset enumeration – Call ListBuckets (S3), compute.instances.list (GCP), networkSecurityGroups.list (Azure) to build a unified inventory.
3. Configuration fetch – Pull JSON/YAML from aws s3api get-bucket-policy, az storage account show, gcloud compute firewall-rules describe.
4. Policy evaluation – Run OPA/Rego policies (example below) against the inventory; thresholds such as “public bucket > 0 objects” trigger a violation.
5. Remediation & reporting – Trigger Terraform taint/apply, send Slack webhook, or open a ticket via ServiceNow API.
Quick comparison
| Vendor | Primary API | Policy Engine | Remediation | Pricing |
|--------|-------------|---------------|-------------|---------|
| Prisma Cloud | AWS, Azure, GCP SDKs | OPA‑compatible | Terraform, Lambda | per‑resource |
| Check Point CloudGuard | Cloud‑native SDKs | Built‑in DSL | Cloud‑formation, Ansible | per‑node |
| Orca Security | Agentless API | Rego | Direct API patch | per‑asset |
| Wiz | Cloud APIs | Custom rule engine | Terraform, Azure CLI | per‑TB scanned |
| AWS Security Hub | AWS APIs | GuardDuty + Config rules | CloudFormation StackSets | per‑account |
package cspm.s3.public
deny[msg] {
bucket := input.buckets[_]
bucket.public == true
bucket.objectCount > 0
msg = sprintf("Public bucket %s contains %d objects", [bucket.name, bucket.objectCount])
}Gotcha: In multi‑account environments, if the CSPM role lacks organizations:ListAccounts or iam:ListRoles permissions, resources in un‑listed accounts are invisible, producing false‑negative findings.