CSPM key terms

A division of security duties between a cloud provider and its customer. The provider secures the underlying infrastructure, while the customer secures data, identities, configurations, and workloads they place in the cloud.

A category of tooling that continuously discovers cloud resources, compares their configuration against security baselines and policy, and reports or remediates drift, misconfiguration, and compliance violations.

Security tooling focused on protecting running workloads such as virtual machines, containers, and serverless functions, covering vulnerability detection, runtime behavior monitoring, and threat response.

The practice and tooling that analyzes identities, permissions, and access paths across cloud environments to identify excessive privileges, unused entitlements, and risky cross-account trust relationships.

The framework of policies, roles, users, and groups that governs who can perform which actions on which cloud resources, forming the primary control boundary in cloud environments.

A principle requiring that every identity receives only the permissions necessary to perform its intended function, for only as long as needed, minimizing the blast radius of compromise or error.

A mechanism where an identity temporarily obtains credentials for another role, often across accounts, governed by a trust policy that defines which principals may assume it and under what conditions.

A flaw where a trusted service is tricked into using its own authority on behalf of an attacker. In cloud, cross-account role trust without a validating condition is a common cause.

A shared secret value a third party supplies when assuming a role, used in the trust policy condition to confirm the request originates from the intended customer rather than an impersonator.

A non-human identity used by applications, automation, or workloads to authenticate to cloud APIs, typically requiring credential rotation, scoping, and monitoring distinct from human accounts.

A chain of permissions or trust relationships that lets an identity with limited rights gain higher privileges, often through role chaining, policy editing rights, or passing roles to compute resources.

Expressing security and compliance rules in machine-readable files that are version-controlled, tested, and evaluated automatically against cloud resources and deployment pipelines.

Managing cloud resources through declarative templates or configuration files rather than manual console actions, enabling repeatable deployments, review, and automated security scanning before provisioning.

The divergence between a resource's intended or approved configuration and its actual live state, often caused by manual changes, which can silently weaken security controls.

A preventive or detective control that constrains what can be deployed or flags unsafe state, such as an organization policy that blocks public storage buckets or a rule alerting on exposed keys.

An organization-level policy that sets the maximum permissions available to accounts within an organizational unit, independent of identity policies, and is commonly used to enforce regional or service restrictions.

A published, versioned set of configuration checks for a platform or service, often mapped to a control framework, that CSPM tools use to score posture and prioritize remediation.

The process of linking technical controls and configuration checks to the requirements of standards such as ISO 27001 or PCI DSS so that posture findings can demonstrate or evidence compliance.

Automated gathering of configuration snapshots, logs, and control test results that auditors use to verify compliance, replacing manual screenshots and interviews with continuous, timestamped records.

A tamper-evident, time-ordered record of administrative and API activity in a cloud environment that supports investigation, accountability, and compliance evidence.

A record of API activity in an AWS account capturing who made a request, from where, when, and with what result, central to detection, forensics, and audit evidence.

The defined period for which log data is kept available and protected from modification or deletion, balancing investigation and compliance needs against storage cost.

A storage configuration that prevents objects from being altered or deleted for a set period, commonly using object lock or legal hold to protect logs and backups from ransomware or insider tampering.

The practice of maintaining protected copies of data and configurations with tested restoration procedures, ensuring resilience against deletion, ransomware, and regional outages.

The plans and architectures that restore services after a major failure, characterized by recovery time and recovery point objectives and often implemented through multi-region or multi-account designs.

The scope of resources, identities, and data that could be affected by a single compromise, misconfiguration, or failure, which segmentation and least privilege are designed to limit.

Dividing a cloud network into isolated zones using subnets, security groups, and routing rules so that a breach in one area cannot freely reach sensitive workloads or data stores.

A stateful virtual firewall attached to cloud resources that permits only explicitly allowed inbound and outbound traffic, evaluated by rules rather than by subnet boundaries.

The condition where a resource such as a storage bucket or database is reachable from the internet, a leading cause of cloud data breaches and a primary CSPM detection target.

Storing and distributing credentials such as API keys and database passwords in a controlled vault with rotation, access logging, and short-lived issuance instead of hardcoding them in code or templates.

A secret embedded directly in source code, container images, or infrastructure templates, easily leaked through repositories and difficult to rotate, making it a frequent finding.

Detection and response applied to running workloads, observing process, file, and network behavior to catch threats that configuration checks cannot see, such as cryptomining or reverse shells.

The use of logs, behavioral baselines, and analytics to identify malicious or anomalous activity in cloud environments, feeding alerts to response workflows.

Responding to a detected posture or threat finding by programmatically correcting it, such as disabling a public bucket or revoking a key, reducing the window of exposure.

Event-driven code executed on managed infrastructure without a persistent server, with security concerns centered on over-broad execution roles, dependency risk, and limited runtime visibility.

Inspecting container images for vulnerable packages, embedded secrets, and misconfiguration before deployment, so unsafe artifacts are blocked prior to reaching production.

Managing security configuration and identity risk consistently across two or more cloud providers, requiring normalized policy, unified inventory, and comparable control assessment.

Applying key-value metadata to cloud resources for ownership, environment, and data classification, enabling scoped policy, cost attribution, and accurate risk prioritization.