When to run it
A cloud security posture backlog where fixes made in the console get overwritten by the next deploy, and auditors ask for proof the controls stay in place.
Fix the Terraform,not just the console.
Fixing cloud misconfigurations at the source
The playbook in one paragraph
Your CSPM tool flags public buckets, wide IAM policies and open security groups. Ana traces each one back to the infrastructure-as-code that created it, fixes it there, and stops it from coming back.
Works with
- CSPM / CNAPP findings (Wiz, Prisma Cloud, AWS Security Hub, Defender for Cloud and others)
- Terraform, Pulumi, CloudFormation or Kubernetes manifests
- AWS, Azure and GCP accounts (read-only to start)
What Ana needs from you
- Accounts and subscriptions in scope
- Which controls frameworks matter (SOC 2, ISO 27001, HIPAA, CIS)
- Who approves IAM and network changes
How Ana runs it
Step by step.
5 steps from trigger to done - each one visible to your team as it happens.
- 01
Trace to source
For each finding Ana finds the IaC resource that owns it - or flags it as drift if it was created by hand.
- 02
Fix in code
Ana changes the module or manifest - tightened policy, private access, encryption, logging - and shows the plan diff so reviewers see exactly what changes in the cloud.
- 03
Add a guardrail
Where it fits, Ana adds a policy-as-code check in CI so the same misconfiguration fails the pipeline next time.
- 04
Route by risk
IAM and network changes go to named approvers through your policy gates; low-risk changes follow normal review.
- 05
Map to controls
Each closed finding is mapped to the control it satisfies, with the change and approval attached as evidence.
Who approves what
Approval gates
- IAM and network changes
- Named cloud security approver
- Apply to production
- Your pipeline and change process
- Drift adoption into IaC
- Platform owner
What you get
Deliverables
- 01IaC pull requests with plan diffs
- 02Policy-as-code checks in CI
- 03Drift report for hand-made resources
- 04Control-mapped evidence
What usually goes wrong
And how Ana handles it.
Risk
Breaking a workload by tightening IAM
Ana checks which principals actually use a permission before removing it and shows that analysis in the PR.
Risk
Console fixes that revert
Fixes land in IaC, and CI checks keep them from regressing.
FAQ
Common questions.
Ana reports it as drift and can propose importing it into IaC so it is managed from then on.
Keep going
Related playbooks.
Security
Clearing a dependency CVE backlog
Your SCA tool reports thousands of vulnerable dependencies and the number never goes down. Ana works out which are actually reachable, upgrades them safely with tests, and documents why the rest can wait.
Read the playbook →SRE / DevOps
Reconciling infrastructure drift
Hot-fixes in the console and manual changes pile up until Terraform plans become scary. Ana finds every drifted resource, decides with you whether code or cloud is right, and brings them back in line.
Read the playbook →Software
Upgrading a framework across dozens of services
A major framework or runtime version is going end-of-life and it touches every service. Ana plans the migration, upgrades each service in its own branch, fixes what breaks, and hands your team small, tested pull requests instead of one terrifying diff.
Read the playbook →See it in your stack
Run this playbook on your systems.
Thirty minutes, your repositories and cloud, one real instance of this job.