Datadog State of Cloud Security Compliance Checker
A Script to simplify compliance checks against Datadog’s State of Cloud Security Report, save time, and reduce risk.
Datadog Report Unveils Critical Cloud Security Gaps
The recent Datadog report on the State of Cloud Security revealed some concerning statistics about the security posture of organizations using cloud platforms. It highlighted areas like the prevalence of long-lived credentials, inadequate adoption of multi-factor authentication, and the exposure of virtual machines to the internet.
Are we compliant?
After reading the report, we were compelled to ask ourselves a crucial question: are we complying with these essential security practices? We knew we needed to find a way to quickly and easily assess our compliance posture.
Our Response: A Tailored AWS Compliance Script
We decided to develop our own script to automate the process of checking our AWS environment against the key findings of the Datadog report. We used Steampipe, a powerful tool for querying cloud APIs, to build this script.
You can access our custom-built script on GitHub repo here.
Here is a preview of our script in action:
The script has the following features corresponding to the facts mentioned in the Datadog’s report on State of Cloud Security.
Fact 1 - Long-lived credentials continue to be a risk - Access Key Rotation
Ensures IAM user access keys are rotated every 90 days or less.
Fact 4 - Adoption of public access blocks in cloud storage services is increasing - S3 Bucket Security
Checks for 'Block public access' settings on S3 Buckets.
Fact 2 - MFA for cloud access is not sufficiently enforced - Multi-Factor Authentication Enforcement
Verifies that all IAM users with console access have MFA enabled.
Fact 6 - Many virtual machines remain publicly exposed to the internet - Public IP Address Check
Confirms that EC2 instances do not have public IP addresses.
Fact 3 - In AWS, IMDSv2 is still widely unenforced, but adoption is rising - IMDSv2 Enforcement
Validates that EC2 instances are configured to use the secure IMDSv2
Fact 5 - A substantial portion of cloud workloads are excessively privileged - Excessive Privileges
- Ensures IAM policies do not grant full " : " administrative privileges, preventing excessive access rights.
- Verifies that IAM Access Analyzer is enabled across all regions, ensuring comprehensive monitoring of access permissions.
*Note: Our reordering of the facts is a deliberate choice, based on our experience in this field. We've placed Fact 4 as a higher priority due to the high risk associated with exposed buckets. Fact 6 is also critical, considering the potential harm from exposed services and instances that are easily discoverable via the internet. Fact 5 is addressed with two controls, acknowledging the need for specific measures against excessively privileged cloud workloads using IAM Policies and Access Analyzer.
Who are stack.io?
For over 15 years, stack.io has been at the forefront of cloud technology, pioneering solutions that simplify and secure cloud management. Our deep expertise in cloud infrastructure and security is embedded in every tool we create, ensuring our clients navigate cloud computing with confidence and ease.
Be a part of Our Journey
At stack.io, we're constantly evolving, and your insights play a pivotal role in our journey. If you have innovative ideas, suggestions for improvements, critical feedback or thoughts on about this custom script, we're all ears. Email us at [email protected] or type your message below.
Your input is the catalyst for our next breakthrough.