Cloud security (CSPM)

Checks the configuration of your AWS accounts, Azure subscriptions and Google Cloud projects against CIS, SOC 2 and ISO 27001 controls, maps how resources are exposed, and tracks drift. The engine is Prowler (open source) running in DVSentry's isolated cloud scanner container. Included in Cloud & AI, Governance and Complete (and the trial).

DVSentry only reads. Every identity below is read-only, DVSentry never creates or changes a cloud resource, and you can revoke access at any time in your own cloud.

#Connect an account (Admin)

Open Cloud → Connect a cloud account and pick the provider. Keyless (recommended) stores no secret at all: DVSentry runs its own OIDC issuer (https://<your DVSentry host>/oidc), and your cloud trusts it once for your organization's subject org:<organization id>. Every DVSentry value in the script is already filled in.

#AWS, keyless (2 steps)

1. Copy the script DVSentry shows and run it in AWS CloudShell. It works in the account CloudShell is signed in to, asks which enabled region to assess (or export DVSENTRY_REGION=... first), shows the account and region and asks before changing anything. In essence it does this (values filled in for you):

   ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
   aws iam create-open-id-connect-provider --url https://app.dvsentry.com/oidc --client-id-list sts.amazonaws.com
   # trust policy: Federated = the provider above, Action = sts:AssumeRoleWithWebIdentity,
   #   Condition: <issuer>:sub = org:<your organization id>, <issuer>:aud = sts.amazonaws.com
   aws iam create-role --role-name DVSentryReadOnly --max-session-duration 3600 \
     --assume-role-policy-document file://dvsentry-trust.json
   aws iam attach-role-policy --role-name DVSentryReadOnly --policy-arn arn:aws:iam::aws:policy/SecurityAudit
   aws iam attach-role-policy --role-name DVSentryReadOnly --policy-arn arn:aws:iam::aws:policy/job-function/ViewOnlyAccess

2. Paste the printed Role ARN (arn:aws:iam::<account>:role/DVSentryReadOnly) and choose Register Credential. DVSentry checks the connection and says exactly which link failed if it does: the token was not accepted, the token could not assume the role, or the role cannot read the account.

Many accounts: download GET /cloud/keyless/aws-cloudformation.yaml (your issuer and subject baked in) and deploy it as a service-managed StackSet from the management account.

New AWS connections that store access keys are refused once keyless AWS is available.

#Azure, keyless

Run the script in Azure Cloud Shell (Bash). It lists every subscription your sign-in can see, in every tenant, and asks which one to assess (or export DVSENTRY_SUBSCRIPTION_ID=... first; DVSENTRY_TENANT_ID is checked if set). A tenant you have not signed in to is not listed: run az login --tenant <tenant id> first. It shows the tenant and subscription and asks before changing anything. It then creates an app registration dvsentry-readonly with a federated credential for DVSentry's issuer and assigns Reader and Security Reader on the subscription. Paste the three ids it prints (tenant, client, subscription). A service principal with a client secret also works.

#Google Cloud, keyless

Run the script in Cloud Shell. It lists the projects your sign-in can see and asks which one to assess (or export DVSENTRY_PROJECT_ID=... first), shows it and asks before changing anything. It then creates a workload identity pool and provider trusting DVSentry's issuer and a service account dvsentry-readonly@<project>.iam.gserviceaccount.com with Viewer and Security Reviewer. Paste the three values it prints. A service account key also works.

Revoke at any time: delete the role or OIDC provider (AWS), the federated credential or app (Azure), or the pool provider (Google Cloud). Each DVSentry call appears in CloudTrail, the Entra sign-in log or Cloud Audit Logs.

#Run a scan

1. Pick the connected account, optionally narrow the regions (widening the registered scope is refused), and run.
2. The scan shows its stage while it collects and evaluates; a full scan of a large account takes several minutes.
3. Open the report: failed controls with resource, severity and control IDs, a plain-language summary (grade, business risks, first actions) and the Topology tab.

API (scope scans:trigger):

curl -sS -X POST "$DVSENTRY_URL/v1/cloud/accounts/$ACCOUNT_ID/scans" \
  -H "Authorization: Bearer $DVSENTRY_TOKEN" -H "Content-Type: application/json" \
  -d '{"environment_name":"production","scope":{"regions":["ap-south-1"]}}'

If the identity lacks a permission, the report names the refused reads. An account is never reported clean while a gap remains.

#What else the Cloud pillar shows

Opt-in features may need one more read-only permission; the opt-in screen names it.

#Release gating on cloud posture

A policy's posture_rules can block a release while any cloud account has an open issue at or above a severity, or has drifted (Policies and gates).

Something missing or unclear? Tell us with Feedback in the app.