tmj-90 Assess cloud posture before attackers do
Cloud misconfigurations are the most common initial-access vector. Find them in review, not in an incident.
The four critical categories
| Category | Most common mistake | Check |
|---|---|---|
| IAM | Privilege escalation via PassRole + AssumeRole + wildcard policies |
No * on Action without explicit justification; no inline policies |
| Storage | Public S3 / GCS / Azure Blob | Block Public Access enabled; no * principal in bucket policies |
| Network | 0.0.0.0/0 ingress on admin ports |
No open 22/3389 to internet; VPC peering limited to known CIDRs |
| IaC | Secrets in .tf/.yml |
No hardcoded credentials; no var with default that contains a secret |
IAM analysis
Work the privilege-escalation graph:
- What actions does this principal have?
- Can it
iam:PassRoleto a more-privileged role? - Can it
sts:AssumeRoleon a wildcard or overly-permissive trust policy? - Does it have
*on resource for any action?
Principle of least privilege: every principal has only the permissions it needs to perform its function, nothing more.
S3 / storage
BlockPublicAcls: true,BlockPublicPolicy: true,IgnorePublicAcls: true,RestrictPublicBuckets: true— all four on every bucket unless public hosting is the explicit purpose.- Bucket policy principal
"*"(unauthenticated) is a BLOCK finding unless the bucket is a public CDN origin. - Server-side encryption (SSE-S3 minimum; SSE-KMS preferred for sensitive data).
- Access logging enabled for compliance buckets.
Network / security groups
- No inbound
0.0.0.0/0or::/0on ports 22 (SSH), 3389 (RDP), 5432 (Postgres), 3306 (MySQL), 27017 (MongoDB). - Egress rules: restrict to known destinations where possible — a blanket
0.0.0.0/0egress allows C2. - VPC flow logs enabled for forensic capability.
IaC security review
- No credentials in
.tf,.yml, or.jsoncommitted to version control. - Provider credentials from environment or secrets manager, not hardcoded.
- Run
tfsec/checkov/kicsin CI; block on HIGH/CRITICAL.
Steps
- Read the lore + existing posture.
search_lorefor past security findings, approved exceptions, and compliance requirements (SOC2, PCI, HIPAA). - Enumerate IAM principals. List roles and users with
*actions or*resources. Map privilege-escalation paths. - Audit storage. Check Block Public Access settings; bucket policies; encryption; logging.
- Audit network. Security groups and NACLs for open admin ports; egress rules.
- Audit IaC. Grep for hardcoded secrets; run static analysis.
- Classify findings. BLOCK (exploitable now), CONCERN (risk without mitigating control), NOTE (hardening opportunity).
- Verify. Re-run checks after remediation; confirm findings are closed; record evidence.
Review checklist
- No
*Action on any IAM policy without documented justification. - Block Public Access on all storage — no exceptions without documented business reason.
- No 0.0.0.0/0 ingress on admin ports — reviewed and closed or restricted.
- No hardcoded credentials in IaC or config files.
- Static analysis clean —
tfsec/checkovwith no HIGH/CRITICAL. - Encryption at rest — enabled on all storage with sensitive data.
Rules
- Public bucket without explicit CDN purpose is a BLOCK finding.
- Wildcard IAM action (
*) without documented justification is a BLOCK finding. - Every cloud account has a posture baseline before any new workload deploys.
Capture lore
Approved security exceptions, compliance requirements, and IAM policy conventions are high-value lore — call suggest_lore with tags: [security, cloud, iam].