# Cloud Audit

> Cloud and container security auditing workflow using prowler, trivy, kube-hunter, and docker-bench for AWS, GCP, Azure, Kubernetes, and container images

- Skill: `commonhuman-lab/cloud-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add commonhuman-lab/cloud-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/commonhuman-lab/cloud-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: commonhuman-lab (https://skillmd.com/u/commonhuman-lab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/commonhuman-lab/cloud-audit

---


# cloud-audit

Cloud and container security auditing workflow for NyxStrike. Use this skill when a user wants to audit AWS/Azure/GCP configurations, scan container images for CVEs, assess a Kubernetes cluster, or check Docker host security.

## Workflow

### AWS / Azure / GCP audit (prowler)

Prowler runs hundreds of compliance checks against cloud provider APIs.

**AWS (default profile):**

```
run_tool(tool="prowler", provider="aws", profile="default")
```

**AWS with specific region and checks:**

```
run_tool(tool="prowler", provider="aws",
         profile="default",
         region="us-east-1",
         checks="s3,iam,ec2")
```

**Azure:**

```
run_tool(tool="prowler", provider="azure",
         additional_args="--az-cli-auth")
```

**GCP:**

```
run_tool(tool="prowler", provider="gcp",
         additional_args="--project-id <gcp_project_id>")
```

Key prowler check categories:

| Category | Checks |
|---|---|
| `iam` | Overprivileged roles, unused access keys, MFA |
| `s3` | Public buckets, encryption, logging |
| `ec2` | Security groups, IMDSv2, public snapshots |
| `rds` | Encryption, public access, backups |
| `cloudtrail` | Logging enabled, log validation |
| `guardduty` | Threat detection enabled |

### Container image vulnerability scan (trivy)

Scan a container image for CVEs, secrets, and misconfigurations:

```
# Scan a Docker image
run_tool(tool="trivy", target="<image>:<tag>", scan_type="image")

# Filter by severity
run_tool(tool="trivy", target="nginx:latest",
         scan_type="image",
         severity="HIGH,CRITICAL")

# Scan a local filesystem
run_tool(tool="trivy", target="/path/to/project", scan_type="fs")

# Scan a running container
run_tool(tool="trivy", target="<container_id>", scan_type="image")
```

### Docker host security benchmark (docker_bench)

Check the Docker host and daemon configuration against CIS Docker Benchmark:

```
run_tool(tool="docker_bench")
```

Focus areas:
- Docker daemon configuration
- Container runtime settings
- Image security (no root, minimal base images)
- Network and logging configuration

### Kubernetes penetration testing (kube-hunter)

Assess a Kubernetes cluster for known attack vectors:

```
# Passive discovery (safe, no exploit attempts)
run_tool(tool="kube-hunter", additional_args="--remote <k8s_api_ip>")

# Active testing (attempts exploitation)
run_tool(tool="kube-hunter", additional_args="--remote <k8s_api_ip> --active")
```

Kube-hunter checks for:
- Unauthenticated API server access
- Exposed kubelet ports (10250/10255)
- RBAC misconfigurations
- Container escape vulnerabilities
- etcd exposure

## Cloud security priorities by risk

| Finding | Severity | Tool |
|---|---|---|
| Public S3 bucket | Critical | prowler (s3) |
| Root account has access keys | Critical | prowler (iam) |
| Critical CVE in container image | Critical | trivy |
| K8s API server unauthenticated | Critical | kube-hunter |
| MFA not enabled | High | prowler (iam) |
| Overprivileged IAM role | High | prowler (iam) |
| Container running as root | High | trivy, docker_bench |
| RDS publicly accessible | High | prowler (rds) |
| CloudTrail not enabled | Medium | prowler (cloudtrail) |

## Typical engagement flow

```
1. prowler (cloud config audit)
   → identify misconfigurations and overprivileged IAM

2. trivy (container/image scan)
   → identify CVEs in deployed images

3. docker_bench (if Docker host access)
   → CIS benchmark gaps

4. kube-hunter (if Kubernetes)
   → runtime cluster attack surface
```

## Tips

- Prowler requires cloud credentials configured (`aws configure`, `az login`, etc.) before running.
- Trivy `CRITICAL` findings should always be addressed before deployment — use it in CI/CD pipelines.
- Kube-hunter `--active` mode actually attempts exploits — only use with explicit authorisation.
- Run trivy against base images as well as final images — vulnerabilities often come from upstream layers.

## NyxStrike Tool Reference

| Tool | Use case |
|---|---|
| `prowler` | AWS/Azure/GCP compliance and security audit |
| `trivy` | Container image / filesystem CVE scan |
| `docker_bench` | Docker CIS benchmark assessment |
| `kube-hunter` | Kubernetes cluster penetration testing |