Cloud Service Provider (CSP) - Auditing Frameworks - Alternatives Analysis

[JJediny]

Conducting a technology audit of our tooling used for Cloud Service Provider management. Needs determine this tool to have a read only ability to audit accounts for users, resources, cost, settings for security and cost management. Previously we: MVPed:

• AirAIM is used in https://github.com/gsa-tts/aws-cleanup to scan users and their permissions across TTS AWS accounts
• Cloud Custodian is used in https://github.com/GSA-TTS/aws-admin/tree/main/custodian to scan resources (databases, virtual machines, storage, etc.) for their utilization and security configurations. Tested:
• Heimdall was tested in https://github.com/GSA-TTS/tts-common-controls to run inspec tests against AWS accounts to scan for CIS Benchmarks to test security configurations using https://saf.mitre.org/libs/harden Actively testing:
• Powerpipe which supports all TTS Cloud providers in (AWS, Azure, GCP). Powerpipes is an open source tool with the functionality to cover all of the use cases TTS Tech Operations previously MVP/Tested. It supports real-time cost, user, and resource monitoring. It has many extensions that allow us to turn our IaaS and SaaS services as data to ingest and query using SQL statements - https://hub.powerpipe.io/ & https://hub.steampipe.io/

  
  ### IT Standards

• [x] Steampipe
• [x] Email For Accessiblity Report required for IT Standards Review
• [ ] Powerpipe

### MVP Deployment
- [x] CircleCI
- [x] Github Actions
- [ ] Cloud.gov App
- [x] Determined Github Actions is best to reduce cost in transit of Markdown Reports

[JJediny]

• [x] Implementing a test run of a benchmark and output and upload test results https://github.com/GSA-TTS/infrastructure/actions/runs/10252429760

Currently following guide on setting up to run across all accounts https://steampipe.io/docs/guides/aws-orgs

[JJediny]

@rahearn Would you be interested in a walkthrough for coordination/awareness with devtools?

[rahearn]

Would you be interested in a walkthrough for coordination/awareness with devtools?

Definitely

[JJediny]

Submitted IT Standards Request for Steampipe Pilot REQ0893713