CloudWatchdog

AWS Cloud Security Posture Monitor

“Severity is a product decision, not a technical one.”

outcomes

20+ AWS checks across IAM, S3, RDS, EC2, VPC, CloudTrail, GuardDuty
4-tier severity framework (CRITICAL → HIGH → MEDIUM → LOW)
Mapped to CIS Benchmark + Security+ domains
LLM remediation mode: ~$0.01/scan (opt-in)
HTML + JSON reports

pm skills

detection schema designseverity prioritization frameworkremediation UXcost-aware AI feature designcompliance mappingDESIGN.md as product artifact

Problem

AWS misconfigurations are the number one cause of cloud breaches. Commercial CSPM tools are expensive black boxes. They flag findings without teaching the why, and they don't provide context-specific remediation. Security posture is a product problem. Most tools treat it as a DevOps checklist.

What I Built

An open-source CSPM scanner with a documented severity framework, 20+ AWS configuration checks, prioritized HTML and JSON reports, and an opt-in LLM remediation mode powered by Claude Haiku.

Approach

Led with the DESIGN.md before writing a single check. Severity is a product decision, not a technical one. Every tier has an explicit rationale, not gut feel, not committee consensus.

Tier	Definition	Example
CRITICAL	Exploitable now, no attacker prep required	Public S3 bucket with sensitive data
HIGH	One step from exploitation	Root account with no MFA
MEDIUM	Compliance gap, no direct exploit today	Missing VPC flow logs
LOW	Defense-in-depth hardening opportunity	Password age policy not enforced

The LLM remediation mode was a deliberate product call: opt-in only, priced at ~$0.01/scan using Claude Haiku, surfaced after findings, not before. Cost-aware AI integration, not AI for AI's sake.

PM Skills Applied

Severity framework is the core PM artifact here. Most security tools assign severity arbitrarily. This one has a documented decision model: exploitability × time-to-exploit × blast radius. The DESIGN.md is a product document, philosophy, tradeoffs, and extension schema included. Any engineer can add a check because the contract is clear.

Technical Depth

Python, boto3, claude-haiku-4-5 for LLM mode. Checks span IAM (access keys, MFA, password policy, wildcard trust), S3 (public access, encryption, logging), RDS (public exposure), EC2 (public IPs, security groups), VPC (flow logs), CloudTrail, GuardDuty, EBS encryption, AWS Config. Unit test suite included.

Lessons

Lesson	Why It Matters
Document the "why" of every design decision	More durable than the decision itself
Opt-in AI features with visible cost signals	Earn trust before you spend it
Security tooling is a UX problem	Prioritized, actionable output beats raw findings

The Story

Built as a PM portfolio artifact targeting security-adjacent product roles. The real insight was about prioritization frameworks. Every PM writes about prioritization. CloudWatchdog shows one in production, a severity model you can read, challenge, and extend. The --llm flag turns findings into context-aware playbooks for a penny a scan. That's the AI-solutions PM instinct applied to a real tool.