{
  "id": 5315890,
  "title": "Your Cloud Security Tool Checks a List. Your Configuration Surface is Not a List.",
  "url": "https://urgent.news/2026/09/03/your-cloud-security-tool-checks-a-list-your-configuration-surface-is",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-03T11:15:01.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/bala_paranj_059d338e44e7e/your-cloud-security-tool-checks-a-list-your-configuration-surface-is-not-a-list-39h9"
  },
  "original_language": "en",
  "account": "Cloud security tools often check if configurations are set up correctly, but they don't verify if those configurations are actually working as intended. For instance, a cloud security tool might confirm that a Secrets Manager secret has rotation enabled, and mark it as compliant, even if the rotation Lambda has been deleted several months ago, and the credential hasn't changed in that time. This gap between configurations and functionality is a structural issue in how cloud security tools approach detection. Security tools generally follow the same pattern: a security researcher identifies an issue, AWS or CIS releases a best practice or benchmark, and then the tool adds a check. However, if no researcher has documented a problem, no tool will check for it. There are three tiers of security coverage: Tier 1 is about known knowns, Tier 2 is about known unknowns, and Tier 3 is about unknown unknowns. The latter includes issues that haven't been conceptualized as a class. To truly secure cloud configurations, one must understand all possible states a configuration can be in and identify which states are harmful. Existing tools only cover surface-level issues that have been discovered and documented, leaving many potential issues unchecked. Identifying these hidden vulnerabilities requires a different starting question: instead of focusing on what issues have been reported, one should ask what all possible states a configuration can be in, and which of those states cause harm. This approach is not limited by what has been discovered or published, but rather by the configuration options available for each service.",
  "summary": "✓ Human-authored analysis; AI used for formatting and proofreading. I traced a production incident back to a Secrets Manager secret that had rotation enabled. The dashboard showed rotation configured. The schedule said 30 days. The compliance report said compliant. The rotation Lambda had been deleted four months ago. The credential hadn't changed in 120 days. The audit said 30. Nobody noticed…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}