Agentless AWS CSPM: posture, cost, and AI risk in one audit
Cloud Security Posture Management is the practice of continuously checking an AWS account for the misconfigurations that quietly create risk. CloudArq is an agentless, read-only AWS CSPM — one read-only IAM role, no agents — that folds security posture, compliance-control mapping, cost waste, and a dedicated AI-workload lens into a single audit, each finding paired with the exact remediation steps.
Updated 2026-07-20 · ~10 minute read
What CSPM actually is (one section)
CSPM — Cloud Security Posture Management — is the discipline of continuously inspecting a cloud account for misconfigurations and risky settings, then guiding you to fix them. Not vulnerabilities in your code, and not live intrusions, but the configuration mistakes that leave a door open: a storage bucket set to public, an IAM policy with a wildcard, a database left unencrypted, CloudTrail switched off in a region, a security group allowing the whole internet to reach a management port. Many cloud breaches trace back to a setting like one of these — not an exotic exploit, just a configuration nobody meant to leave the way it is.
A CSPM tool reads the state of your account, compares it against known-good baselines and framework controls, and surfaces the gaps. The good ones go further and tell you exactly how to close each gap. CloudArq is a CSPM in that mould — with the scope widened to include cost waste and the newest surface, AI workloads, in the same pass.
Why agentless matters
Some posture tools want an agent on every host, or a collector deployed into your account that runs continuously. CloudArq takes the opposite stance. It connects through a read-only IAM role secured with an ExternalId, created from a CloudFormation template, and reads configuration metadata and CloudWatch metrics through the AWS APIs. There is nothing to install, nothing running inside your workloads, and no software to keep patched.
That matters for two reasons. First, blast radius: a read-only role that can look but never touch is a far smaller thing to trust than an agent with a foothold in every instance. Second, time-to-value: you can point CloudArq at an account and get a full posture read from a single read-only pass, without a rollout. The trade-off is honest — an external, agentless audit sees the control-plane and configuration surface, which is where the overwhelming majority of posture risk lives; it does not sit inside a host watching process-level behaviour, and it is not trying to.
What the posture review covers — 6 domains
The full audit runs all 192 CloudArq checks. The posture side groups into the domains below — each one a cluster of specific, provable conditions read from your AWS metadata. The identifiers are real scanner check IDs; each describes a capability the read-only audit surfaces, never an observed behaviour.
Four lenses, one read-only pass
A classic CSPM stops at security posture. CloudArq runs three more lenses over the same account in the same audit, so you are not stitching four tools together to see one picture.
Security posture
Misconfigurations and risky settings across identity, network, encryption, logging, and data protection — the core CSPM surface, each finding with the exact fix.
Compliance mapping
Findings mapped to the controls of eight compliance frameworks (tier-gated), so a posture gap reads as a specific control gap — for evidence, not a certification.
Cost waste
Idle, oversized, and orphaned resources across compute, storage, networking, and databases — a per-resource estimate and remediation steps, no headline savings claim.
AI-workload lens
A dedicated lens over Amazon Bedrock agents, AgentCore, RAG, guardrails, residency, and AI spend — control-plane metadata only, read-only, never touching agent data.
The AI-workload lens is covered in depth on the AI Workload and Bedrock security pages; the compliance mapping has a per-framework breakdown starting from the SOC 2 checklist and the Well-Architected review.
How it works
Where AWS-native tools fit
AWS ships its own building blocks, and they are legitimate and useful. AWS Security Hub aggregates and normalises findings from AWS security services; AWS Config records how your resources are configured over time; GuardDuty is a threat-detection service; and Trusted Advisor runs a set of cost, security, and service-limit checks. All of these are signals from inside your own account.
CloudArq is an independent, agentless external audit. It adds the exact remediation for each finding, a mapping to compliance-framework controls, cost waste, and an AI-workload lens — a different vantage point, not a replacement. Many teams run the native services for continuous in-account signal and CloudArq for the outside-in review and the fix. There is a longer, honest side-by-side on the CloudArq vs AWS-native security page, and a build-vs-buy breakdown on the scanner build-vs-buy page.
What the posture findings look like
open_sshpublic_s3no_mfa_rootunencrypted_rdsbedrock_invocation_logging_offIllustrative only — sample rows, not a real account. Each real finding groups under its posture domain and its mapped compliance controls, and ships with remediation steps.
Frequently asked
- 01What is CSPM, and how is CloudArq’s approach different?
- CSPM — Cloud Security Posture Management — is the discipline of continuously checking a cloud account for misconfigurations and risky settings: public storage, over-broad IAM, unencrypted data, disabled logging, exposed network paths. CloudArq is an agentless, read-only AWS CSPM that runs the whole posture review from a single read-only IAM role. What sets it apart is scope in one audit: security posture, a mapping of findings to compliance-framework controls, cost waste, and a dedicated AI-workload lens — each finding paired with the exact remediation steps.
- 02Is CloudArq really agentless? How does it connect?
- Yes. There are no agents, sidecars, or daemons to install, and nothing to run inside your workloads. CloudArq connects through a read-only IAM role secured with an ExternalId — you create the role from a CloudFormation template, and the audit reads configuration metadata and CloudWatch metrics through the AWS APIs. It never stores your credentials, application data, database contents, or S3 objects.
- 03Does CloudArq change anything in my account, or fix issues automatically?
- No. The audit is read-only end to end and never auto-fixes. Every finding ships with remediation steps — the exact CLI command, console path, or Terraform block — but you apply the change and stay in control. It is detection plus the fix, never an automatic action on your account and never a hard stop on your workloads.
- 04Does CloudArq replace AWS-native tools like Security Hub or GuardDuty?
- They are complementary, and the honest answer is you can run both. AWS Security Hub aggregates and normalises findings from AWS security services, GuardDuty is a threat-detection service, and AWS Config records resource configuration — all signals from inside your own account. CloudArq is an independent, agentless external audit that adds exact remediation for each finding, a mapping to compliance-framework controls, cost waste, and an AI-workload lens. Many teams use the native services for continuous in-account signal and CloudArq for the outside-in review and the fix.
- 05How does the posture map to compliance frameworks?
- CloudArq maps its automated checks to the controls of eight compliance frameworks (tier-gated — see the pricing page for which tier maps which subset). It shows posture against those controls; it does not certify or guarantee compliance, and CloudArq the business holds no certifications itself. A scanner evidences configuration; the attestation is still an auditor’s job.
- 06Does the CSPM cover AI and Bedrock workloads?
- Yes. Alongside the classic posture and cost checks, the Max tier adds a dedicated AI-workload lens covering Amazon Bedrock agents, AgentCore, RAG knowledge bases, guardrails, data residency, and AI spend. It reads control-plane and configuration metadata only, is read-only, and never touches agent data or model traffic. See the AI workload and Bedrock security pages for the full picture.