- CheckMates
- :
- Products
- :
- CloudMates Products
- :
- CNAPP
- :
- Re: CSPM unused assets
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
CSPM unused assets
Is there a way to generate a report to show assets in AWS/Azure that have not been used or touched for a period of time?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Dankline,
We only check the configuration and meta data of the objects, so we will not see if an application is running or not on an instance or what objects have being uploaded on an S3 bucket.
Once said that, we can enforce different lifecycle rules according to the status or the configuration of the different services:
Make sure that S3 have lifecycle rules :
S3Bucket should have lifecycle.rules
Or ensure older objects are being deleted after a period of time:
S3Bucket should have lifecycle.rules contain [ expiration.days<=365 ]
Or sent to an archive bucket after a certain period of time:
S3Bucket should have lifecycle.rules with [ transition.storageClass='STANDARD_IA' and days<=180 ]
Or identify instances that have being running for more than a year:
Instance where (not tags with [ key='app' and value='prod' ]) and isRunning=true should not have launchTime before(-12, 'months')
Or users that have not connected to AWS in a period of time:
IamUser where passwordEnabled=true should not have passwordLastUsed before(-6,'months')
The GSL language is very powerful and allows customer to very easily translate their own configuration and lifecycle posture into rules that can be continuously enforced and monitored. Once the rules are created and added to a continuous policy you can create reports or widgets to visualize the status of the lifecycle configuration policy.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, Gonzalo. Do we have a similar capability, using GSL in Azure? I'm interested in being able to identify VMs that are no longer being used, and orphaned vnets, etc. Is there GSL documentation that can help in crafting these rules?
Dan
![](/skins/images/A53DAF99EDBAFE11A1FC6E62F510C235/responsive_peak/images/icon_anonymous_message.png)