Fleet Marshal

Cloud Security Prevention Platform (CSPP) for AWS Organizations

Proof of Concept / MVP

Fleet Marshal is an active Proof of Concept (MVP) demonstrating the shift from reactive Cloud Security Posture Management (CSPM) to proactive Cloud Security Posture Prevention (CSPP). It brings automated multi-account guardrail enforcement, pre-flight impact assessment, and 1-click remediation to AWS Organizations.

Launch Live App (fleetmarshal.cloud) View App Repository Security Policies (IaC)
16+ Security Controls
1-Click Safe Remediation
100% Multi-Account Orgs
31 Serverless Lambdas

The Paradigm Shift: CSPM vs. CSPP

Traditional Cloud Security Posture Management (CSPM) tools monitor environments and generate alerts after misconfigurations have already been deployed into production. This leads to alert fatigue, persistent backlogs, and exposed attack surfaces.

Fleet Marshal introduces Cloud Security Posture Prevention (CSPP)—a security-first model that focuses on establishing organizational guardrails, enforcing immutable Service Control Policies (SCPs), and eliminating vulnerabilities at the source through automated, verifiable remediation.

Traditional CSPM (Reactive)

  • Post-deployment detection: Flags problems after resources are live.
  • Alert Fatigue: Floods security and DevOps teams with thousands of tickets.
  • Manual Ticket Resolution: Long mean time to remediation (MTTR).
  • Blind spots: No baseline guardrail prevention against root/IAM misuse.

Fleet Marshal CSPP (Preventative)

  • Preventative Guardrails: Organization-wide SCPs block high-risk actions.
  • 1-Click Remediation: Enforce encryption, public block, and policies instantly.
  • Safe Dry-Runs & Snapshots: Pre-state capture with one-click rollback.
  • GitOps / IaC Alignment: Automated Terraform PRs and state management.

Goals & Core Capabilities

AWS Organizations Integration

Connects entire AWS Organizations via cross-account IAM roles with External IDs. Automatically discovers member accounts and detects existing AWS Control Tower setups.

One-Click Remediation & Dry-Run

Preview remediation changes with dry-run diffs and cross-account impact assessments before applying fixes like S3 Block Public Access, EBS default encryption, or Root lockdown.

Snapshot & 1-Click Rollback

Every remediation action captures an immutable pre-state snapshot in DynamoDB, enabling instant one-click rollback if operational dependencies are discovered.

Automated 24h Compliance Scans

EventBridge schedules automated 24-hour compliance scans across all connected member accounts, generating historical compliance trends and tracking score changes over time.

Tamper-Evident Audit Trail

Maintains a comprehensive audit log of all user actions, remediation events, and invitations with category filtering and instant CSV export for SOC 2 & ISO compliance.

Multi-Tenant RBAC & Admin Panel

Amazon Cognito authentication with fine-grained Admin, Viewer, and ReadOnly roles, email team invitations, and demo mode with nightly automated test resets.

Preventative Security Controls Enforced

Fleet Marshal scans and remediates baseline security guardrails across 6 critical operational domains:

Domain Control ID Security Guardrail Remediation Mechanism
Storage storage-1 S3 Account-Level Block Public Access AWS API + Organization SCP Enforcement
Storage storage-2 S3 Bucket Default Encryption (AES256) Terraform S3 Bucket Policy Module
Storage storage-3 EBS Encryption by Default (All Regions) EC2 API Cross-Region Automation
IAM iam-1 Root User Lockdown Service Control Policy (SCP) via Management Acct
IAM iam-5 Account Password Policy Enforcement IAM Account Alias & Credential Baseline
Database db-1 DynamoDB Point-in-Time Recovery (PITR) DynamoDB Continuous Backup Policy
Logging logging-1/2/3 Multi-Region CloudTrail + Log Validation CloudTrail Baseline + S3 Access Logging
Monitoring monitor-1 Unauthorized API Call CloudWatch Alarms CloudWatch Metric Filter + SNS Topic Alarm

Cloud Native Architecture

Fleet Marshal is built entirely on a modern serverless, event-driven architecture designed for high scalability and zero idle cost:

[CloudFront + Edge Functions] (SPA Router & Security Headers) │ ▼ ┌────────────────────────────────────────────────────────┐ │ React + Vite Single-Page Application (S3 Static Host) │ └──────────────────────────┬─────────────────────────────┘ │ ▼ [API Gateway + Amazon Cognito Authentication & RBAC] │ ▼ ┌────────────────────────────────────────────────────────┐ │ 31 Python 3.11 Serverless Lambda Microservices │ │ - Connections CRUD - Impact Assessment Engine │ │ - Multi-Account Scanner - Snapshot & Revert Handler │ │ - Remediation Pipeline - Audit Logger & CSV Exporter │ └──────────────────────────┬─────────────────────────────┘ │ ┌──────────────────────┼──────────────────────┐ ▼ ▼ ▼ [8 DynamoDB Tables] [EventBridge Schedules] [Amazon SES Alerts] (Multi-Tenant Data) (24h Scan & Demo Sync) (Compliance Thresholds)

Technology Stack

AWS Organizations Service Control Policies (SCPs) AWS Lambda (Python 3.11) React + Vite Amazon DynamoDB Amazon Cognito CloudFront Edge Functions Serverless Framework Terraform (GitOps) Amazon SES Amazon EventBridge

Open Fleet Marshal MVP Explore All Open Source Projects Back to Home