Learn
LoginRegister
← All playbooks

Professional workflow · Cloud

Cloud security assessment

Objective

Review IAM, logging, and common misconfigurations in an authorized cloud account and produce a posture report.

Authorized scope

Accounts/subscriptions listed in RoE. No destructive changes; prefer read-only APIs. No other customers’ tenancies.

Prerequisites

  • Cloud Security course
  • Read-only auditor role in scope
  • Architecture overview from owners
Course →Roadmap L18 →

Step-by-step workflow

  1. Step 01

    Account inventory

    • List accounts, regions, critical workloads
    • Confirm shared-responsibility boundaries

  2. Step 02

    IAM & identity

    • Review admin principals and MFA
    • Hunt wildcards and unused keys
    • Check federation / SSO posture

  3. Step 03

    Data & network exposure

    • Public storage / open security groups
    • Logging enabled (CloudTrail-style) and retention
    • Kubernetes/container RBAC samples if in scope

  4. Step 04

    Report

    • Map findings to risk
    • Provide fix snippets / policy examples
    • Agree retest for critical items

Expected evidence

  • Read-only role assumption proof
  • Finding screenshots / CLI outputs (redacted)
  • Prioritized posture list

Checklist

  • RoE lists account IDs
  • No write actions without change ticket
  • Secrets in outputs redacted

Reporting template

Cloud assessment — [provider/account]
Scope: […]
IAM highlights: […]
Exposure findings: […]
Logging gaps: […]
Remediation roadmap: 30/60/90 days

Remediation

  • Enforce MFA and least-privilege IAM
  • Block public storage by policy
  • Turn on org-wide logging and alerts

Related tools