# Cloud posture, on autopilot

DevSecOps case study, 2026. Role: Lead DevOps Engineer · owner.

An in-house GCP security compliance and alerting platform, plus an org-wide audit that moved workloads to keyless identity.

- 953 SA keys surfaced
- 40 security checks
- 8 compliance frameworks
- 175 unrestricted API keys

## The problem

A couple of incidents made it clear that infrastructure security needed continuous monitoring, not periodic reviews. The organisation runs many GCP projects across squads, and nobody had a single view of how they measured up against CIS, ISO 27001, PCI DSS or NIST, or of how many long-lived credentials were in circulation.

## How it works

### Scan everything, continuously

Prowler runs org-wide on a schedule, scoring every project against 40 checks mapped to 8 compliance frameworks, including internal policies.

### Make it visible

Findings land in OpenSearch with posture and asset-inventory dashboards, and automated daily and weekly reports go to stakeholders, so security is a shared number, not a spreadsheet.

### Audit the credentials

Cloud Asset Inventory exposed 953 user-managed service-account keys and 175 unrestricted API keys across the organisation.

### Fix it with the squads

Remediation was driven squad by squad, working closely with the Information Security team, and workloads moved to keyless Workload Identity Federation, including Velero on every GKE cluster.

## Outcome

- Continuous, framework-mapped posture monitoring across the whole GCP organisation.
- Long-lived keys replaced by Workload Identity Federation, starting with backup tooling on every cluster.
- Security and engineering leads recognised the work as a model for cross-functional delivery.

> Couple of incidents led to thinking to implement tighter monitoring on the infrastructure, taking the idea to completion all the credit should go to Kirat.
>
> Phani Kumar Patchava, Cloud Posture Monitoring · Sep 2026

Stack: Prowler, Cloud Asset Inventory, OpenSearch, Workload Identity Federation, Velero, GKE.

Next case study: [Incidents that explain themselves](https://kirat.space/work/ai-ops)

---

Kirat Pal Singh Lamba, Lead DevOps Engineer, Bengaluru, India.

- [kirat.lamba10@gmail.com](mailto:kirat.lamba10@gmail.com)
- [LinkedIn](https://www.linkedin.com/in/kirat-pal-singh-lamba-00893b147/)
- [GitHub](https://github.com/skirat)
- [Medium](https://medium.com/@skirat)