TechPrufer
Get started
Spotify
Spotify logoSpotify · Feature trail

Cloud Security Automation Platform

2 posts · Jan 2017 – Aug 2017

What this trail covers

Spotify is enhancing its cloud security posture by developing and leveraging automated tools for auditing and enforcing security configurations on Google Cloud Platform. This includes building an inventory of resources, running scanners for misconfigurations, and automatically fixing violations. The goal is to scale security hardening efforts alongside development speed and provide better visibility and audit trails for incident investigation.

All Spotify trails
  1. Stepping Up the Cloud Security GameThis post details the development and initial deployment of Forseti, an open-source security tool for Google Cloud Platform, created in partnership with Google. Forseti provides an inventory of cloud resources, runs scanners to detect security misconfigurations (e.g., public GCS buckets, exposed CloudSQL instances, IAM policy violations, bogus firewall rules), and offers automated enforcement capabilities to fix identified issues. The post highlights the scale of auditing achieved and the benefits of automated alerting to asset owners.
  2. Google Cloud Security ToolboxThis post details the open-sourcing of two internal Spotify tools: GCP-Audit and GCP-Firewall-Enforcer. GCP-Audit scans Google Cloud projects for common security issues (e.g., inadequate storage bucket permissions, exposed Compute Engine instances, misconfigured CloudSQL) using an expandable rules repository. GCP-Firewall-Enforcer continuously enforces an audited set of firewall rules across multiple projects, automatically detecting and fixing accidental alterations to mitigate risks and maintain control of firewall policies.