PolicyPing
A continuous monitor that watches your secretsmanager, s3 and kms resources and alerts when an attached resource policy is missing, too permissive, or has drifted from the Terraform source — so teams relying on compensating controls don't accidentally lose them on the next terraform apply.
Platform engineers in regulated environments who use resource policies as compensating controls
- Drift detector comparing live resource policies to the Terraform state file
- Alert channel that pings Slack when a resource policy is deleted or widened outside Terraform
- Audit log export suitable for SOC2/ISO evidence
- One-click remediation PR that re-applies the intended resource policy
The article proves resource policies are load-bearing — losing one silently re-enables a broad identity policy — yet no tool currently watches for that drift.
HN source post has only 18 points and 0 comments, indicating weak engagement; no searches surfaced organic demand signals for this specific niche.Monitor AWS Secrets Manager secrets for compliance by using AWS Config ↗How to use AWS Config to determine compliance of AWS KMS key policies to your specifications ↗
Market is already crowded: AWS Config natively checks Secrets Manager/KMS policy compliance, Snyk owns driftctl, Cloud Custodian covers rule-based governance, and DriftWatch specifically targets IAM/SG/S3 policy drift.GitHub - snyk/driftctl: Detect, track and alert on infrastructure drift ↗GitHub - 0xAlpha-21/DriftWatch: Automated AWS resource configuration drift monitor for IAM policies, Security Groups, and S3 bucket posture ↗Cloud Custodian — Rules engine for cloud resources ↗
Hard to monetize against a first-party AWS service (AWS Config) and multiple free OSS tools (driftctl, Cloud Custodian); buyers already pay AWS Config per-rule pricing and rarely buy point solutions for this.AWS Config rules for Secrets Manager compliance ↗Cloud Custodian (open source) ↗
Compensating-control patterns and resource policies are durable concerns in regulated environments, but AWS is steadily absorbing the use case into native Config capabilities, limiting long-term differentiation.Detect infrastructure drift and enforce policies | Terraform / HCP ↗
Straightforward to build using existing AWS APIs and Terraform state; only added complexity is parsing HCL source to match declared resource policies, but all building blocks are well documented.AWS Config RDK for KMS key policy rules ↗