Cloud Security Assessment Methodology
Multi-cloud READ-ONLY security assessment using the cloud_audit tool. All checks use describe/list/get CLI calls via native TypeScript — no Python dependency, no SDK imports. Uses aws/az/gcloud CLIs. Aligned with CIS benchmarks for AWS, Azure, and GCP.
Safety First
ALWAYS run verify_readonly before any other audit program. This confirms the current credentials have no dangerous write permissions. If the check returns FAIL, stop and request read-only credentials.
cloud_audit verify_readonly --provider all
Assessment Phases
Phase 1 — Credential Safety Verification
| Check |
Command |
Purpose |
| Verify read-only |
cloud_audit verify_readonly --provider all |
Confirm no write permissions — MUST pass before proceeding |
Phase 2 — Identity & Access Management
IAM is the most critical attack surface in cloud environments.
| Provider |
Command |
Key Checks |
| AWS |
cloud_audit aws_iam_audit --json-output |
MFA status, wildcard policies, unused keys, cross-account trust, root access keys |
| Azure |
cloud_audit azure_iam_audit --json-output |
Dangerous role assignments (Owner/Contributor), subscription-level owners, wildcard custom roles |
| GCP |
cloud_audit gcp_iam_audit --json-output |
Primitive roles (Owner/Editor at project), SA key age >90d, domain-wide delegation |
Intelligence integration: After IAM audit, report findings via add_intel with type infrastructure:
add_intel type=infrastructure data="IAM audit: 3 users without MFA, 2 wildcard policies found"
Phase 3 — Storage Security
Public storage buckets are the #1 cloud data breach vector.
| Provider |
Command |
Key Checks |
| AWS |
cloud_audit aws_storage_audit --json-output |
S3 Block Public Access, ACLs, default encryption, versioning, access logging |
| Azure |
cloud_audit azure_storage_audit --json-output |
Blob public access, HTTPS-only, minimum TLS version, SAS policies |
| GCP |
cloud_audit gcp_storage_audit --json-output |
allUsers/allAuthenticatedUsers bindings, uniform bucket-level access, versioning |
Phase 4 — Network Security
Open security groups and missing flow logs are common misconfigurations.
| Provider |
Command |
Key Checks |
| AWS |
cloud_audit aws_network_audit --json-output |
SGs open to 0.0.0.0/0 on dangerous ports, IMDSv1, VPC flow logs |
| Azure |
cloud_audit azure_network_audit --json-output |
NSG Any/Any rules, public IPs on VMs, NSG flow logs |
| GCP |
cloud_audit gcp_network_audit --json-output |
Firewall rules open to 0.0.0.0/0, external IPs, legacy networks |
Phase 5 — Encryption at Rest
Unencrypted storage is a compliance violation in most frameworks.
| Provider |
Command |
Key Checks |
| AWS |
cloud_audit aws_encryption_audit --json-output |
EBS/RDS encryption, KMS key rotation, CMK vs AWS-managed |
| Azure |
cloud_audit azure_encryption_audit --json-output |
Disk encryption, storage CMK, Key Vault rotation |
| GCP |
cloud_audit gcp_encryption_audit --json-output |
Disk/SQL/GCS CMEK, KMS key rotation |
Phase 6 — Logging & Monitoring
Missing audit logs mean attacks go undetected.
| Provider |
Command |
Key Checks |
| AWS |
cloud_audit aws_logging_audit --json-output |
CloudTrail multi-region, GuardDuty, Config recorder |
| Azure |
cloud_audit azure_logging_audit --json-output |
Activity Log retention, Diagnostic settings, Defender status |
| GCP |
cloud_audit gcp_logging_audit --json-output |
Audit log config (DATA_READ/DATA_WRITE), log sinks, filters |
Phase 7 — DNS & TLS
External-facing services need DNS security and valid TLS.
| Check |
Command |
Key Checks |
| DNS |
cloud_audit dns_audit --domain TARGET |
Dangling CNAMEs (subdomain takeover), DNSSEC, CAA records |
| TLS |
cloud_audit tls_audit --target HOST:PORT |
Protocol version, certificate expiry, cipher strength, HSTS |
Vulnerability Reporting
For each FAIL finding, report via report_vulnerability:
report_vulnerability
title: "AWS IAM user without MFA: admin-user"
severity: high
evidence:
requestSent: "cloud_audit aws_iam_audit --json-output"
responseCode: 0
responseSummary: "checkId AWS-IAM-001 FAIL — user admin-user has console access without MFA"
reasoning: "CIS AWS 1.10 requires MFA for all IAM users with console access"
Coverage Notes
Use record_coverage_note with scope: "wide" for account-level findings:
record_coverage_note
scope: wide
note: "AWS IAM audit complete — 5 findings across 12 users. No root access keys detected."
Program Reference
| Program |
Domain |
Providers |
| verify_readonly |
Safety |
AWS, Azure, GCP |
| aws_iam_audit |
IAM |
AWS |
| azure_iam_audit |
IAM |
Azure |
| gcp_iam_audit |
IAM |
GCP |
| aws_storage_audit |
Storage |
AWS |
| azure_storage_audit |
Storage |
Azure |
| gcp_storage_audit |
Storage |
GCP |
| aws_network_audit |
Network |
AWS |
| azure_network_audit |
Network |
Azure |
| gcp_network_audit |
Network |
GCP |
| aws_encryption_audit |
Encryption |
AWS |
| azure_encryption_audit |
Encryption |
Azure |
| gcp_encryption_audit |
Encryption |
GCP |
| aws_logging_audit |
Logging |
AWS |
| azure_logging_audit |
Logging |
Azure |
| gcp_logging_audit |
Logging |
GCP |
| dns_audit |
DNS |
Cross-cloud |
| tls_audit |
TLS |
Cross-cloud |
1---2name: cloud-assessment3description: Multi-cloud READ-ONLY security assessment methodology for AWS, Azure, and GCP using CIS benchmark-aligned checks4---56# Cloud Security Assessment Methodology78Multi-cloud READ-ONLY security assessment using the `cloud_audit` tool. All checks use describe/list/get CLI calls via native TypeScript — no Python dependency, no SDK imports. Uses aws/az/gcloud CLIs. Aligned with CIS benchmarks for AWS, Azure, and GCP.910## Safety First1112**ALWAYS run `verify_readonly` before any other audit program.** This confirms the current credentials have no dangerous write permissions. If the check returns FAIL, stop and request read-only credentials.1314```15cloud_audit verify_readonly --provider all16```1718## Assessment Phases1920### Phase 1 — Credential Safety Verification2122| Check | Command | Purpose |23|-------|---------|---------|24| Verify read-only | `cloud_audit verify_readonly --provider all` | Confirm no write permissions — MUST pass before proceeding |2526### Phase 2 — Identity & Access Management2728IAM is the most critical attack surface in cloud environments.2930| Provider | Command | Key Checks |31|----------|---------|------------|32| AWS | `cloud_audit aws_iam_audit --json-output` | MFA status, wildcard policies, unused keys, cross-account trust, root access keys |33| Azure | `cloud_audit azure_iam_audit --json-output` | Dangerous role assignments (Owner/Contributor), subscription-level owners, wildcard custom roles |34| GCP | `cloud_audit gcp_iam_audit --json-output` | Primitive roles (Owner/Editor at project), SA key age >90d, domain-wide delegation |3536**Intelligence integration:** After IAM audit, report findings via `add_intel` with type `infrastructure`:37```38add_intel type=infrastructure data="IAM audit: 3 users without MFA, 2 wildcard policies found"39```4041### Phase 3 — Storage Security4243Public storage buckets are the #1 cloud data breach vector.4445| Provider | Command | Key Checks |46|----------|---------|------------|47| AWS | `cloud_audit aws_storage_audit --json-output` | S3 Block Public Access, ACLs, default encryption, versioning, access logging |48| Azure | `cloud_audit azure_storage_audit --json-output` | Blob public access, HTTPS-only, minimum TLS version, SAS policies |49| GCP | `cloud_audit gcp_storage_audit --json-output` | allUsers/allAuthenticatedUsers bindings, uniform bucket-level access, versioning |5051### Phase 4 — Network Security5253Open security groups and missing flow logs are common misconfigurations.5455| Provider | Command | Key Checks |56|----------|---------|------------|57| AWS | `cloud_audit aws_network_audit --json-output` | SGs open to 0.0.0.0/0 on dangerous ports, IMDSv1, VPC flow logs |58| Azure | `cloud_audit azure_network_audit --json-output` | NSG Any/Any rules, public IPs on VMs, NSG flow logs |59| GCP | `cloud_audit gcp_network_audit --json-output` | Firewall rules open to 0.0.0.0/0, external IPs, legacy networks |6061### Phase 5 — Encryption at Rest6263Unencrypted storage is a compliance violation in most frameworks.6465| Provider | Command | Key Checks |66|----------|---------|------------|67| AWS | `cloud_audit aws_encryption_audit --json-output` | EBS/RDS encryption, KMS key rotation, CMK vs AWS-managed |68| Azure | `cloud_audit azure_encryption_audit --json-output` | Disk encryption, storage CMK, Key Vault rotation |69| GCP | `cloud_audit gcp_encryption_audit --json-output` | Disk/SQL/GCS CMEK, KMS key rotation |7071### Phase 6 — Logging & Monitoring7273Missing audit logs mean attacks go undetected.7475| Provider | Command | Key Checks |76|----------|---------|------------|77| AWS | `cloud_audit aws_logging_audit --json-output` | CloudTrail multi-region, GuardDuty, Config recorder |78| Azure | `cloud_audit azure_logging_audit --json-output` | Activity Log retention, Diagnostic settings, Defender status |79| GCP | `cloud_audit gcp_logging_audit --json-output` | Audit log config (DATA_READ/DATA_WRITE), log sinks, filters |8081### Phase 7 — DNS & TLS8283External-facing services need DNS security and valid TLS.8485| Check | Command | Key Checks |86|-------|---------|------------|87| DNS | `cloud_audit dns_audit --domain TARGET` | Dangling CNAMEs (subdomain takeover), DNSSEC, CAA records |88| TLS | `cloud_audit tls_audit --target HOST:PORT` | Protocol version, certificate expiry, cipher strength, HSTS |8990## Vulnerability Reporting9192For each FAIL finding, report via `report_vulnerability`:9394```95report_vulnerability96 title: "AWS IAM user without MFA: admin-user"97 severity: high98 evidence:99 requestSent: "cloud_audit aws_iam_audit --json-output"100 responseCode: 0101 responseSummary: "checkId AWS-IAM-001 FAIL — user admin-user has console access without MFA"102 reasoning: "CIS AWS 1.10 requires MFA for all IAM users with console access"103```104105## Coverage Notes106107Use `record_coverage_note` with `scope: "wide"` for account-level findings:108```109record_coverage_note110 scope: wide111 note: "AWS IAM audit complete — 5 findings across 12 users. No root access keys detected."112```113114## Program Reference115116| Program | Domain | Providers |117|---------|--------|-----------|118| verify_readonly | Safety | AWS, Azure, GCP |119| aws_iam_audit | IAM | AWS |120| azure_iam_audit | IAM | Azure |121| gcp_iam_audit | IAM | GCP |122| aws_storage_audit | Storage | AWS |123| azure_storage_audit | Storage | Azure |124| gcp_storage_audit | Storage | GCP |125| aws_network_audit | Network | AWS |126| azure_network_audit | Network | Azure |127| gcp_network_audit | Network | GCP |128| aws_encryption_audit | Encryption | AWS |129| azure_encryption_audit | Encryption | Azure |130| gcp_encryption_audit | Encryption | GCP |131| aws_logging_audit | Logging | AWS |132| azure_logging_audit | Logging | Azure |133| gcp_logging_audit | Logging | GCP |134| dns_audit | DNS | Cross-cloud |135| tls_audit | TLS | Cross-cloud |
cyberstrikeus