Skip to main content

CSPM (Cloud Security Posture)

CSPM (Cloud Security Posture) is a self-serve, stateless cloud posture check. You provide an asset inventory as JSON, pick the cloud (AWS, Azure, or GCP), and the scan returns prioritized findings. It does not connect to your cloud accounts and does not store the inventory you submit.

Who this is for​

Security and cloud engineers in a workspace who want a fast misconfiguration check on an exported cloud asset inventory without standing up a connected scanner. Available on Pro and Enterprise plans.

Role-based start here​

  • Cloud / platform engineer: export an asset inventory and run a scan to triage misconfigurations before a change goes out.
  • Security reviewer: use the findings and severities to prioritize fixes and attach them to a ticket.
  • Workspace admin: confirm the capability is enabled on your plan.

Before you start​

  • Confirm your plan includes CSPM (Pro or Enterprise).
  • Have an asset inventory ready as a JSON array. Each asset needs an id, a resource_type, and a properties object.
  • Decide which cloud the inventory is for (AWS, Azure, or GCP).

Step-by-step​

  1. Open CSPM (#/cspm).
  2. On the Assets tab, select the cloud and paste your asset inventory JSON.
  3. Click Run CSPM scan.
  4. Open the Findings tab to review each flagged resource, its rule, the message, and the severity.

What the Findings tab shows​

The Findings tab always tells you which of four states you are in, so a blank panel never leaves you guessing:

  • While a scan runs: a loading state ("Running CSPM scan…").
  • If the scan fails: the failure reason is shown in the Findings tab itself (for example cspm engine offline), not only next to the button — so you see it even if you switch tabs after starting the scan.
  • After a clean scan: "No findings — posture looks clean", confirming the scan ran and found no control failures for the pasted assets.
  • Before you have run anything: "No findings yet", with a prompt to set your cloud and assets on the Assets tab and run a scan.

Day-2 operations​

  • Re-run the scan after remediating, using an updated inventory export, to confirm findings clear.
  • Keep the inventory export current so results reflect live posture.
  • Track recurring findings as candidates for guardrails earlier in your pipeline.

Self-check playbook​

  • Paste the sample inventory (a public-read bucket and an open security group) and confirm you get two findings.
  • Submit an inventory with only well-configured assets and confirm zero findings.
  • Submit an invalid cloud value and confirm the scan reports cloud_invalid.

What each button does​

  • Cloud selector: chooses which cloud rule packs to evaluate against.
  • Assets JSON textarea: the inventory the scan evaluates.
  • Run CSPM scan: submits the inventory and loads findings.
  • Overview / Assets / Findings tabs: posture context, asset input, and the resulting control failures.

Troubleshooting​

  • "Invalid assets JSON": the textarea must contain a JSON array of assets.
  • cloud_invalid: the cloud must be aws, azure, or gcp.
  • assets_required_list: assets must be a list, even if empty.
  • No findings on a misconfigured asset: confirm the resource_type and properties match what the rule packs expect (see the sample).

API and automation​

  • POST /api/cspm/scan with { "cloud": "aws|azure|gcp", "assets": [ ... ] } returns { "cloud": "...", "findings": [ {resource, rule, message, severity} ] }.
  • Authenticated, licensed workspace access is required.
  • The scan is stateless: nothing is stored and no cloud account is contacted.

Known limits and rate limits​

Boundary classification: add-on security module.

Dralvia expands this module only when customer demand, evidence quality, support readiness, and clear operating limits are in place.

Use the standard Dralvia evidence workflow and TicketBridge handoff for escalations where this module produces reviewable evidence.

Integration boundary: stateless asset-inventory scan by API, findings review, and standard incident handoff.

  • CSPM evaluates the asset inventory you submit; it does not discover cloud assets or connect to your AWS, Azure, or GCP account.
  • Large inventories should be split into smaller batches that fit normal API request-size and workspace rate-limit controls.
  • Results reflect the submitted export at scan time. Re-export after remediation before treating a finding as cleared.

API error quick reference​

ErrorMeaningWhat to do now
401 UnauthorizedSession token is missing, expired, or invalid.Sign out and back in, then retry once.
403 ForbiddenYour role is authenticated but not allowed to run a posture scan, or your plan does not include CSPM.Ask your workspace admin to grant access or upgrade the plan.
404 Not FoundThe route was not found in the current workspace context.Confirm the /api/cspm/scan path and workspace context, then retry.
429 Too Many RequestsYour rate limit or quota window was exceeded.Wait for cooldown, then retry with backoff.
500 Internal Server ErrorThe backend failed unexpectedly.Retry after a short wait. If it repeats, escalate with the UTC time.

Next best actions​

  • Wire the API into a pre-deploy check so an inventory export is scanned before changes ship.
  • Route high-severity findings to TicketBridge for follow-up.
  • Review usage quotas before adding automated scans to CI.
  • Send recurring posture issues to TicketBridge for ownership and follow-up.
  • Use the CSPM feature overview when explaining the scanner model to cloud teams.

FAQ​

  • Does this connect to my AWS/Azure/GCP account? No. You provide the inventory; the scan is stateless and stores nothing.
  • Which clouds are supported? AWS, Azure, and GCP rule packs.
  • Is my inventory retained? No. It is evaluated and discarded.

Next steps​