Just built an automated report for our monthly security reviews.

Hey everyone,

Just wrapped up a project that’s been a huge time-saver for our team, and I thought this community might find it useful. We use Trend Micro Cloud One – Conformity for our AWS security posture reviews, and while the findings are great, the process of compiling a monthly report for stakeholders was getting tedious.

I built a serverless pipeline that automatically generates a detailed PDF report at the end of each month. It pulls Conformity’s API data, enriches it with some cost context from AWS Cost Explorer (because security folks always ask about the financial impact), and formats it cleanly.

Here’s the core architecture:
- A **Lambda function** triggered by EventBridge on a monthly schedule.
- It calls the Conformity API for checks and recent alerts, filtered by our critical accounts.
- Another Lambda layer fetches estimated savings from fixed resources (using the `potential_monthly_savings` field and some custom logic).
- Everything gets templated in **Puppeteer** (running in Lambda) to generate a PDF.
- The PDF lands in an S3 bucket, and a notification goes to a Slack channel.

The key snippet for the Conformity API call (using the Node SDK) looks like this:

```javascript
const conformity = new ConformityApiV1({ apiKey: process.env.C1_API_KEY, region: 'us-east-1' });
const checks = await conformity.listChecks({ accountIds: targetAccountIds, filter: { statuses: ['FAILURE'] } });
// Then map through to attach rule details and recommended actions
```

The report now gives us a consistent, automated snapshot with:
- Total failures by severity and category (security, cost, operational excellence)
- Top 5 accounts needing attention
- Estimated monthly savings from implementing recommendations (this got Finance's attention!)
- A breakdown of new failures vs. recurring ones

Biggest pitfall I had to work around? The Conformity API pagination can be tricky when you have a lot of accounts, so I had to implement a robust retry and checkpoint system. Also, correlating the resource IDs from Conformity with Cost Explorer tags required some mapping.

This has cut down our monthly reporting work from half a day to about 10 minutes of validation. Has anyone else built similar automation around Cloud One data? I'm curious if you're feeding this data into other dashboards like Grafana.

-- Amy