How We Built 433 Cloud Scan Rules Across 6 Provider Categories
433 scan rules across AWS, Azure, GCP, Kubernetes, on-prem, and multi-cloud. Here’s the architecture that makes them discoverable, testable, and extendable by any engineer.
433 scan rules across AWS, Azure, GCP, Kubernetes, on-prem, and multi-cloud. Here’s the architecture that makes them discoverable, testable, and extendable by any engineer.
AWS calls it ‘UsageType’. Azure calls it ‘MeterCategory’. GCP calls it ‘service.description’. FOCUS 1.2 gives them all the same name. That matters more than it sounds.
Filing a claim is a side effect of resolving a breach. If it fails, the breach must still be resolved correctly. Here’s how we designed for that.
AWS says ‘resolved’. GCP says ‘SOLUTION_PROVIDED’. Azure says ‘closed’. If you don’t translate before acting on these, you’ll mark valid credits as denied — silently.
Breach detection is only step one. The real complexity is in quantification, filing windows, month-boundary splits, and credit calculation. Here’s the full lifecycle.