DriftWatch: An Automated Cloud Security Posture Management Framework for Infrastructure Configuration Drift Detection and Multi-Standard Compliance Mapping

The dynamic nature of modern cloud computing has introduced significant security challenges, most notably configuration drift; where live runtime cloud environments deviate from established security baselines.Whether caused by manual console interventions, automated scripts, or deployment errors, unchecked drift increases the attack surface, exposes sensitive data, and violates strict regulatory compliance standards.Furthermore, traditional reactive auditing processes often lead to alert fatigue and compliance debt.To address these critical gaps, this paper presents DriftWatch, an automated, agentless Cloud Security Posture Management (CSPM) framework designed for continuous, real-time detection and visualization of infrastructure drift across multi-cloud environments.Unlike conventional auditing tools that rely heavily on static Infrastructure-as-Code (IaC) state files, DriftWatch directly queries live cloud provider APIs to evaluate the true, absolute runtime state of cloud assets.This data is processed through a centralized Policy-as-Code engine that normalizes findings into actionable threat context.While the overarching architecture is designed to be fully cloud-agnostic and scalable, this study validates the engine through a robust working prototype integrated with Amazon Web Services (AWS).The prototype successfully audits core compute, storage, network, and identity services against a pre-established baseline of 40 specific technical controls cross-mapped to CIS Benchmarks, ISO/IEC 27001, GDPR, and India's Digital Personal Data Protection Act (DPDPA 2023).By bridging the gap between live runtime configurations and multi-jurisdictional privacy regulations, DriftWatch delivers a scalable, high-efficiency solution that enables organizations, especially SME's, to shift from reactive audits to proactive, continuous cloud governance.