Expert Advice

Pro Tips

Expert advice for running Cloudsploit effectively in production environments. Optimize performance, manage false positives, automate scans, and integrate into your security workflow.

Scan Performance

Optimize Thread Count

Use 10-20 threads for most accounts. Increase to 50+ for large enterprises but watch for API rate limits.

bash

1cloudsploit scan aws --threads 20

Region Limiting

Scan only active regions. Most companies use 2-4 regions, not all 25+ AWS regions.

bash

1cloudsploit scan aws --regions us-east-1,us-west-2,eu-west-1

Service Targeting

Target high-risk services first: IAM, S3, EC2, RDS. Add others later.

bash

1cloudsploit scan aws --services iam,s3,ec2,rds

Credential Management

Use IAM Roles on EC2

When running Cloudsploit from an EC2 instance, attach an IAM role instead of storing access keys.

Rotate Keys Regularly

Access keys used for scanning should rotate every 90 days. Set calendar reminder.

Least Privilege

Start with readonly policies. Add specific permissions only when detectors fail due to access issues.

bash

1# Minimal IAM policy for AWS scanning
2{
3  "Version": "2012-10-17",
4  "Statement": [
5    {
6      "Effect": "Allow",
7      "Action": [
8        "ec2:Describe*",
9        "s3:Get*", "s3:List*",
10        "iam:Get*", "iam:List*",
11        "rds:Describe*"
12      ],
13      "Resource": "*"
14    }
15  ]
16}

False Positive Management

Build Suppression Lists

Maintain a suppression file for known safe configurations that trigger detectors.

bash

1# ~/.cloudsploit/suppressions.txt
2S3_BUCKET_PUBLIC_READ  # Static website bucket
3EC2_SECURITY_GROUP_OPEN_TO_WORLD  # Public load balancer SG
4IAM_USER_ACCESS_KEYS_OLDER_THAN_90_DAYS  # Break-glass account

Custom Detector Overrides

Write custom detectors that check additional context before flagging.

Resource Exemptions

Exempt specific resources by ARN rather than suppressing entire detector.

bash

1cloudsploit scan aws \
2  --exempt-resources "arn:aws:s3:::public-website-*,arn:aws:ec2:us-east-1:123456789012:security-group/sg-*"

Automation & Scheduling

Daily Quick Scans

Run quick scans daily via cron/cron job. Full weekly scans on weekends.

bash

1# Daily quick scan (6 AM)
20 6 * * * cloudsploit scan aws --quick --quiet
3 
4# Weekly full scan (Sunday 2 AM)
50 2 * * 0 cloudsploit scan aws --comprehensive

CI/CD Integration

Run compliance scans on PRs to infrastructure repos. Fail builds on critical findings.

Slack/Teams Notifications

Parse output and send alerts to chat channels for urgent findings.

bash

1#!/bin/bash
2cloudsploit scan aws --severity critical --output json > results.json
3if [ $(jq length results.json) -gt 0 ]; then
4  curl -X POST -H 'Content-type: application/json' \
5    --data '{"text":"Critical cloud security issues found!"}' \
6    $SLACK_WEBHOOK_URL
7fi

Reporting & Communication

Executive Summary

Export to HTML for stakeholder reports. Include remediation timeline and risk ratings.

Dev Team Handoff

Export CSV with Resource ID and Remediation steps. Filter by environment tag.

bash

1cloudsploit scan aws \
2  --services ec2,s3,rds \
3  --output csv \
4  --outfile dev-team-findings.csv

Trend Analysis

Store historical scan results. Track findings over time to measure improvement.

bash

1# Archive each scan
2mkdir -p ~/scan-archive/$(date +%Y-%m)
3cloudsploit scan aws --output json --outfile ~/scan-archive/$(date +%Y-%m)/scan-$(date +%Y%m%d-%H%M).json

Advanced Techniques

Custom Detector Development

Write JavaScript detectors for organization-specific policies. Share across teams.

bash

1// ~/.cloudsploit/detectors/required-tags.js
2module.exports = {
3  name: "RESOURCE_MISSING_REQUIRED_TAGS",
4  description: "Resources must have Environment and Owner tags",
5  category: "Governance",
6  severity: "MEDIUM",
7  
8  async run(provider) {
9    const resources = await provider.getAllResources();
10    for (const res of resources) {
11      const hasEnv = res.tags?.Environment;
12      const hasOwner = res.tags?.Owner;
13      if (!hasEnv || !hasOwner) {
14        this.addIssue(
15          `Missing required tags on ${res.type} ${res.id}`,
16          res.id,
17          `Add Environment and Owner tags`
18        );
19      }
20    }
21  }
22};

Parallel Multi-Cloud Scanning

Scan AWS, Azure, GCP simultaneously using background processes for faster total runtime.

bash

1# Run all three in parallel
2cloudsploit scan aws --output json --outfile aws.json &
3cloudsploit scan azure --output json --outfile azure.json &
4cloudsploit scan gcp --output json --outfile gcp.json &
5wait
6echo "All scans complete"

Detector Debugging

Use verbose mode to see detailed detector execution and API calls.

bash

1cloudsploit scan aws --services s3 --verbose 2>&1 | grep "S3_BUCKET"

Security Best Practices

Never Scan Without Authorization

Always have written permission before scanning any cloud account. Use tagged scan accounts.

Protect Scan Results

Scan results contain sensitive infrastructure details. Encrypt reports at rest and in transit.

Separate Scanner Credentials

Use dedicated IAM/service principal for scanning. Never share with personal accounts.

Monitor Scanner Activity

Enable CloudTrail/Activity Log for the scanner account itself. Detect unauthorized use.

Scan Scheduling Strategies

Daily Quick Scan

High-risk services only, 5-10 minutes. Catches new issues fast.

bash

1cloudsploit scan aws --quick --quiet --severity critical

Weekly Deep Scan

All services, all regions. Comprehensive but slow.

bash

1cloudsploit scan aws --comprehensive --output html --outfile weekly-report.html

Monthly Compliance

CIS/NIST/PCI compliance checks for audit purposes.

bash

1cloudsploit scan aws --compliance cis --output pdf --outfile compliance.pdf

Next: CI/CD Integration