Comprehensive DevSecOps Tutorial: CloudHealth by VMware

by

1. Introduction & Overview

What is CloudHealth by VMware?

CloudHealth by VMware is a cloud management platform that simplifies financial management, streamlines operations, and enhances security and compliance across multi-cloud environments. It supports platforms like AWS, Azure, and Google Cloud Platform (GCP), offering tools for cost optimization, security monitoring, and policy automation. CloudHealth enables organizations to align cloud operations with business objectives through actionable insights and governance.

History or Background

Founded in 2012 in Boston, Massachusetts, by Joe Kinsella, with Dan Phillips and Dave Eicher as co-founders, CloudHealth Technologies initially focused on cloud cost management. Over time, it expanded into governance, automation, and security. VMware acquired CloudHealth in 2018, integrating it into the VMware Tanzu portfolio. As of 2025, CloudHealth manages over $8 billion in cloud spend and secures millions of cloud assets, making it a key player in multi-cloud management.

Why is it Relevant in DevSecOps?

DevSecOps integrates security into the DevOps lifecycle, emphasizing automation, collaboration, and continuous monitoring. CloudHealth supports DevSecOps by:

  • Cost Optimization: Aligns cloud spending with efficiency and accountability goals.
  • Security Posture Management: Identifies misconfigurations and compliance risks in real time, critical for secure CI/CD pipelines.
  • Automation: Enables policy-driven governance to reduce manual security checks and speed up deployments.
  • Visibility: Provides insights into resource usage for secure and cost-effective operations.

2. Core Concepts & Terminology

Key Terms and Definitions

  • Perspectives: Custom business groups in CloudHealth for analyzing cloud data by team, project, or cost center.
  • FlexReports: Customizable reports for detailed cost, usage, and security analysis.
  • CloudHealth Secure State (CHSS): A module for real-time security and compliance monitoring, detecting misconfigurations and risks.
  • Policies: Rules for governing cloud resources, automating cost control, and ensuring compliance.
  • Cost Reallocation Rules: Mechanisms to assign indirect costs to specific resources or business units.
TermDefinition
PoliciesRule sets to enforce governance (e.g., cost limits, security policies)
ReportsScheduled or on-demand analytics for usage, cost, and compliance
CloudHealth Secure StateSecurity and compliance monitoring across cloud accounts
PerspectivesCustom views or groupings of cloud assets (e.g., by team, BU, project)
RightsizingRecommendations to optimize resource usage and reduce waste
Tag GovernanceMonitoring and standardizing cloud tagging strategies

How It Fits into the DevSecOps Lifecycle

CloudHealth integrates across the DevSecOps lifecycle:

  • Plan: Defines budgets and security policies for cloud resources.
  • Build: Integrates with CI/CD tools like VMware Code Stream to enforce security checks during development.
  • Deploy: Uses CHSS to scan deployments for misconfigurations, ensuring secure releases.
  • Operate: Monitors resource usage and compliance in real time.
  • Monitor: Provides dashboards and alerts for ongoing security and cost oversight.
DevSecOps PhaseCloudHealth Role
PlanBudget forecasting, cost planning
DevelopPre-deployment cost/security estimates
Build/TestCompliance rules integration in CI/CD
Release/DeployPolicy-driven automation hooks
OperateReal-time insights and anomaly detection
MonitorContinuous cost/security monitoring
SecureEnforce policies, alert on misconfigurations

3. Architecture & How It Works

Components

  • CloudHealth Platform: Core tool for cost, usage, and performance analytics.
  • CloudHealth Secure State (CHSS): Security module for real-time threat detection and compliance monitoring.
  • APIs and Integrations: GraphQL and REST APIs for programmatic access and CI/CD integration.
  • Dashboards and Reports: Customizable interfaces for visualizing cloud metrics.

Internal Workflow

  1. Data Collection: CloudHealth uses read-only roles (e.g., AWS SecurityAudit) to collect configuration and usage data from cloud providers.
  2. Analysis: Processes data to generate insights on cost, performance, and security.
  3. Policy Enforcement: Applies user-defined policies to automate actions like budget alerts or resource cleanup.
  4. Reporting: Delivers insights via dashboards, FlexReports, or integrations like Slack.

Architecture Diagram Description

The architecture includes:

  • Cloud Providers: AWS, Azure, GCP, feeding data to CloudHealth.
  • CloudHealth Platform: Central hub for processing data and applying policies.
  • CHSS Module: Scans for security risks and integrates with CI/CD pipelines.
  • User Interface/APIs: Dashboards and APIs for user interaction and automation.
  • Integrations: Connects to tools like VMware Code Stream, Slack, or email for alerts.
[Cloud Providers] --> [CloudHealth Connectors/API] --> [Normalization Engine]
                               |
                               V
                        [Policy Engine]
                               |
                               V
                 [Dashboards | Reports | Alerts]

Integration Points with CI/CD or Cloud Tools

  • VMware Code Stream: CHSS scans deployments for misconfigurations.
  • Cloud Assembly: Deploys application blueprints with CHSS security validation.
  • Slack/Email: Real-time alerts for policy violations or budget thresholds.
  • GraphQL Explorer: Enables programmatic queries for custom automation.

4. Installation & Getting Started

Basic Setup or Prerequisites

  • Cloud Accounts: AWS, Azure, or GCP accounts with read-only access roles.
  • Permissions: IAM roles (e.g., AWS SecurityAudit) for CloudHealth to scan resources.
  • Network: Stable internet for accessing the CloudHealth UI and APIs.
  • Browser: Modern browser for the CloudHealth portal.

Hands-on: Step-by-Step Beginner-Friendly Setup Guide

  1. Sign Up for CloudHealth:
  • Visit https://www.vmware.com/products/cloudhealth.html and request a free trial.
  • Log in to the CloudHealth portal with your credentials.

2. Onboard an AWS Account:

    • Navigate to Setup > Accounts > Add Account.
    • In AWS Management Console, create an IAM role:
    # Create IAM Role in AWS
aws iam create-role --role-name CloudHealthRole --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"910887748405"},"Action":"sts:AssumeRole","Condition":{"StringEquals":{"sts:ExternalId":"YOUR_EXTERNAL_ID"}}}]}'
aws iam attach-role-policy --role-name CloudHealthRole --policy-arn arn:aws:iam::aws:policy/SecurityAudit
    • Enter the ARN and External ID in the CloudHealth onboarding wizard.

    3. Configure CHSS:

      • Go to Secure State > Onboarding and enable real-time event streams (e.g., AWS CloudWatch).
      • Set scan frequency (daily, weekly, or monthly).

      4. Set Up a Dashboard:

        • Navigate to Dashboards > Add Dashboard.
        • Choose a template (e.g., Overview) and select context (organization or project).

        5. Create a Budget Policy:

          • Go to Governance > Policies > Create Policy.
          • Define a budget threshold (e.g., alert at 80% of monthly spend).

          6. Test Integration:

            • Deploy a test application via VMware Code Stream and verify CHSS scans for misconfigurations.

            5. Real-World Use Cases

            Scenario 1: Securing CI/CD Pipelines

            A DevSecOps team uses CloudHealth Secure State with VMware Code Stream to deploy a web application on AWS. CHSS scans for misconfigurations (e.g., open S3 buckets) in under two minutes, pausing the pipeline if risks are detected. The team approves or rolls back the deployment based on findings.

            Scenario 2: FinOps for Engineering Teams

            An engineering team sets budgets per project using CloudHealth Perspectives. FlexReports track EC2 instance costs by cost center, identifying overspending. Automated policies alert when budgets near 80%, enabling proactive cost management.

            Scenario 3: Compliance in Healthcare

            A healthcare provider uses CHSS to ensure HIPAA compliance across AWS and Azure. The platform monitors for misconfigured IAM roles and unencrypted storage, generating compliance reports aligned with regulatory frameworks.

            Scenario 4: MSP Customer Management

            A managed service provider (MSP) uses the CloudHealth Partner Platform to manage multiple client accounts, isolating usage and costs. Branded dashboards provide clients with visibility, while automated policies optimize resource usage.

            6. Benefits & Limitations

            Key Advantages

            • Multi-Cloud Visibility: Unified view of AWS, Azure, and GCP resources.
            • Real-Time Security: CHSS detects misconfigurations quickly, critical for DevSecOps pipelines.
            • Cost Optimization: Reduces cloud spend by up to 35% through waste identification.
            • Automation: Policy-driven governance minimizes manual intervention.

            Common Challenges or Limitations

            • Learning Curve: Complex configurations may overwhelm new users.
            • Dependency on Cloud APIs: Limited by the capabilities of cloud provider APIs.
            • Cost: Subscription costs may be high for small organizations (pricing details at https://x.ai/grok).
            • Integration Setup: Requires technical expertise to configure CI/CD integrations.

            7. Best Practices & Recommendations

            Security Tips

            • Enable CHSS real-time event streams for immediate threat detection.
            • Use least-privilege IAM roles for CloudHealth access.
            • Regularly update security policies to align with MITRE ATT&CK Cloud Matrix.

            Performance

            • Use FlexReports to segment data by team or project for faster analysis.
            • Schedule scans during off-peak hours to minimize performance impact.

            Maintenance

            • Review dashboards weekly to identify trends in usage or security risks.
            • Update cost reallocation rules to reflect organizational changes.

            Compliance Alignment

            • Map CHSS compliance templates to standards like HIPAA or GDPR.
            • Automate remediation for common misconfigurations (e.g., open ports).

            Automation Ideas

            • Integrate CHSS with CI/CD pipelines to halt deployments with high-risk findings.
            • Use GraphQL APIs to automate custom reporting workflows.

            8. Comparison with Alternatives

            | Feature                | CloudHealth by VMware | Cloudability by Apptio | CloudCheckr by NetApp |
|------------------------|-----------------------|------------------------|-----------------------|
| Multi-Cloud Support    | AWS, Azure, GCP       | AWS, Azure, GCP        | AWS, Azure, GCP       |
| Security Monitoring    | Real-time (CHSS)      | Limited                | Strong, but slower    |
| Cost Optimization      | Advanced (FlexReports)| Strong                 | Moderate              |
| CI/CD Integration      | VMware Code Stream    | Limited                | Partial               |
| Ease of Use            | Moderate              | High                   | Moderate              |
| Pricing                | Subscription-based    | Subscription-based     | Subscription-based    |

            When to Choose CloudHealth

            • Choose CloudHealth: For robust security integration in DevSecOps pipelines, especially with VMware tools, or when managing large-scale multi-cloud environments.
            • Choose Alternatives: Cloudability for simpler cost management or CloudCheckr for detailed compliance reporting without CI/CD focus.

            9. Conclusion

            CloudHealth by VMware is a powerful tool for DevSecOps teams, offering visibility, security, and cost optimization across multi-cloud environments. Its integration with CI/CD pipelines and real-time security monitoring makes it ideal for organizations prioritizing secure, efficient cloud operations. As cloud adoption grows, CloudHealth’s automation and analytics will remain critical for managing complexity.

            Next Steps

            • Explore the CloudHealth Documentation (https://techdocs.broadcom.com/us/en/vmware-tanzu/tanzu-cloudhealth.html) for detailed guides.
            • Join the VMware Community for support and best practices.
            • Experiment with a free trial to test integrations with your CI/CD tools.

            Leave a Comment