Overview
In this guide, we will build a real-time Cloud Security Posture Management (CSPM) system using only AWS native services and Grafana:
- CSPM Compliance Findings collected
- Stored in DynamoDB
- Exposed via a REST API Gateway
- Visualized in Grafana in real-time
This solution is serverless, cost-effective, and scalable — ideal for security teams who want instant compliance monitoring without expensive commercial CSPM products.
Architecture Diagram
Solution Components
| Component | Purpose |
|---|---|
| AWS Lambda | Runs CSPM compliance checks and saves findings |
| AWS DynamoDB | Stores findings (resource ID, issue, severity, timestamp) |
| AWS API Gateway | Provides REST API to expose findings |
| Grafana | Visualizes findings through JSON API datasource |
Key Features
- Real-time compliance visibility
- Historical tracking of violations
- Filtering findings by severity, resource, or time window
- Fully serverless and low-cost
How It Works
- CSPM Lambda Scanner runs compliance checks (e.g., S3 buckets, EC2 public IPs).
- Findings are saved into DynamoDB with timestamp and metadata.
- A second Lambda function exposes findings over API Gateway.
- Grafana connects to the API to build real-time dashboards.
Advanced API Query Filters Supported
| Query Parameter | Purpose |
|---|---|
severity | Filter findings by severity (High, Medium, Low) |
resource_id | Get findings for a specific resource |
hours | Limit findings to the last X hours |
Example API Calls:
/findings?severity=High/findings?resource_id=s3-bucket-123/findings?hours=12
GitHub Repository
Download Full Code and Instructions
https://github.com/securebytesblog/securebytes-cspm-serverless
Conclusion
Building your own real-time CSPM system is easier than you think!
By using AWS Lambda, DynamoDB, API Gateway, and Grafana, you can have full visibility into your cloud security posture without heavy licensing costs.
Stay tuned for more such cloud security automation guides at SecureBytesBlog.com! 🚀
Nice share!