Module 26: Continuous Security Automation

Track 5 · Prowler + Claude Code · Time: ~40 min · Pass: 8/10

Scenario

You've built detection (Module 23), remediation (Module 24), and reporting (Module 25). The final step is making them run on a schedule, with safe autonomy, so the platform improves while engineering sleeps. Cloudsmiths wants a "Prowler Pride" workflow: every morning, the agent finds, files, fixes (drafts), and reports.

Loop step taught here: the closed loop: Find → Prioritize → Explain → Plan → Execute → Verify, repeated on a schedule, with verification feeding the next scan. The Prowler side (scans, findings, schedules such as prowler_cloud_set_scan_schedule (Prowler Cloud)) is agent-agnostic, so any MCP-capable agent or SOC bot can drive it; only the scheduler you use to wake the agent is client-specific. Define autonomy bands and keep per-agent, least-privilege keys (see Module 22).

Learning objectives

1. Design a multi-step continuous security workflow.
2. Schedule recurring Claude Code agent runs.
3. Build a drift detector that diffs posture week-over-week.
4. Define autonomy boundaries that match your org's risk appetite.