Policy-as-Code

# PosturaNet remediation policy — S3 public bucket
api_version: v1
kind: RemediationPolicy
metadata:
  name: s3_public_bucket
  description: Blocks public read/write ACLs and bucket policies on S3.
  owner: security-team
spec:
  severity: high
  action: remediate
  resource_types: [aws_s3_bucket]
  rule_ids: [S3_PUBLIC_BUCKET]
  fix:
    block_public_acls: true
    block_public_policy: true
    ignore_public_acls: true
    restrict_public_buckets: true
  approval: required
  notify: [security-oncall]