cloud-pentest

name	cloud-pentest
description	Multi-cloud CSPM assessment using ScoutSuite/Prowler with IAM privilege escalation, storage exposure, and network posture for AWS/Azure/GCP
license	MIT
metadata	{"category":"recon","locale":"en","phase":"v1"}

What this skill does

Performs a structured cloud security assessment across AWS, Azure, and GCP. Runs automated multi-cloud audits with ScoutSuite and Prowler, then performs deep manual analysis of IAM privilege escalation paths, storage exposure, network posture, and serverless configurations. Produces a findings report with CIS benchmark violations, attack narratives, and IaC remediation examples.

When to use

• When performing a cloud security posture assessment (CSPM) against an authorized environment
• When auditing IAM roles and policies for overpermissive grants or privilege escalation paths
• When checking storage buckets/blobs for public exposure or weak access controls
• When reviewing network security groups, NACLs, and VPC endpoint configurations
• When mapping serverless function attack surfaces (Lambda, Azure Functions, Cloud Functions)

Prerequisites

pip install scoutsuite prowler-cloud pacu
# ScoutSuite also requires cloud provider CLIs:
# AWS CLI:   pip install awscli
# Azure CLI: https://learn.microsoft.com/cli/azure/install-azure-cli
# gcloud:    https://cloud.google.com/sdk/docs/install

Inputs

Variable	Required	Description
SECSKILL_CLOUD_PROVIDER	required	Target provider: aws, azure, or gcp
AWS_PROFILE	AWS	Named AWS CLI profile to use
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY	AWS (alt)	Static AWS credentials
AZURE_SUBSCRIPTION_ID	Azure	Target Azure subscription ID
GCP_PROJECT_ID	GCP	Target GCP project ID
SECSKILL_OUTPUT_DIR	optional	Directory for results (default: ./output)
SECSKILL_SCOPE	optional	Comma-separated services to limit scan scope

Workflow

Step 1: Identify cloud provider and validate credentials

export PROVIDER="${SECSKILL_CLOUD_PROVIDER:?Set SECSKILL_CLOUD_PROVIDER to aws, azure, or gcp}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
TIMESTAMP=$(date -u '+%Y%m%dT%H%M%SZ')
mkdir -p "$OUTDIR"

case "$PROVIDER" in
  aws)
    echo "[*] Validating AWS credentials..."
    aws sts get-caller-identity || { echo "[-] AWS credentials invalid"; exit 1; }
    ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
    echo "[+] AWS account: $ACCOUNT_ID"
    ;;
  azure)
    echo "[*] Validating Azure credentials..."
    az account show --subscription "${AZURE_SUBSCRIPTION_ID:?Set AZURE_SUBSCRIPTION_ID}" \
      || { echo "[-] Azure credentials invalid"; exit 1; }
    echo "[+] Azure subscription: $AZURE_SUBSCRIPTION_ID"
    ;;
  gcp)
    echo "[*] Validating GCP credentials..."
    gcloud config set project "${GCP_PROJECT_ID:?Set GCP_PROJECT_ID}"
    gcloud auth application-default print-access-token > /dev/null \
      || { echo "[-] GCP credentials invalid"; exit 1; }
    echo "[+] GCP project: $GCP_PROJECT_ID"
    ;;
  *)
    echo "[-] Unknown provider: $PROVIDER (use aws, azure, or gcp)"
    exit 1
    ;;
esac

echo "[+] Credential validation passed"

Step 2: Run automated assessment (ScoutSuite + Prowler)

echo "[*] Running ScoutSuite automated audit..."
SCOUT_OUT="$OUTDIR/scoutsuite_${PROVIDER}_${TIMESTAMP}"

case "$PROVIDER" in
  aws)
    python3 -m scout aws --report-dir "$SCOUT_OUT" --no-browser 2>&1 \
      | tee "$OUTDIR/scoutsuite_run.log"
    ;;
  azure)
    python3 -m scout azure --cli --subscription-id "$AZURE_SUBSCRIPTION_ID" \
      --report-dir "$SCOUT_OUT" --no-browser 2>&1 \
      | tee "$OUTDIR/scoutsuite_run.log"
    ;;
  gcp)
    python3 -m scout gcp --user-account --project "$GCP_PROJECT_ID" \
      --report-dir "$SCOUT_OUT" --no-browser 2>&1 \
      | tee "$OUTDIR/scoutsuite_run.log"
    ;;
esac

echo "[*] Running Prowler compliance checks..."
PROWLER_OUT="$OUTDIR/prowler_${PROVIDER}_${TIMESTAMP}"
mkdir -p "$PROWLER_OUT"

case "$PROVIDER" in
  aws)
    prowler aws --output-directory "$PROWLER_OUT" \
      --output-formats json,csv --compliance cis_1.5_aws 2>&1 \
      | tail -20
    ;;
  azure)
    prowler azure --subscription-id "$AZURE_SUBSCRIPTION_ID" \
      --output-directory "$PROWLER_OUT" --output-formats json,csv \
      --compliance cis_2.0_azure 2>&1 | tail -20
    ;;
  gcp)
    prowler gcp --project-id "$GCP_PROJECT_ID" \
      --output-directory "$PROWLER_OUT" --output-formats json,csv \
      --compliance cis_2.0_gcp 2>&1 | tail -20
    ;;
esac

echo "[+] Automated assessment complete"

Step 3: IAM analysis

Reference: See REFERENCE.md for per-provider IAM analysis CLI commands (AWS/Azure/GCP).

echo "[*] Performing IAM analysis..."
IAM_OUT="$OUTDIR/iam_analysis_${TIMESTAMP}.txt"
# Run provider-specific IAM commands from REFERENCE.md for $PROVIDER
echo "[+] IAM analysis written to $IAM_OUT"

Step 4: Storage and data exposure check

Reference: See REFERENCE.md for per-provider storage security check commands (AWS S3, Azure Storage/Key Vault, GCP Cloud Storage).

echo "[*] Checking storage and data exposure..."
STORAGE_OUT="$OUTDIR/storage_exposure_${TIMESTAMP}.txt"
# Run provider-specific storage commands from REFERENCE.md for $PROVIDER
echo "[+] Storage exposure check written to $STORAGE_OUT"

Step 5: Network security review

Reference: See REFERENCE.md for per-provider network review commands (AWS security groups/NACLs/IMDSv1/VPC endpoints, Azure NSGs, GCP firewall rules/GKE).

echo "[*] Reviewing network security configuration..."
NET_OUT="$OUTDIR/network_security_${TIMESTAMP}.txt"
# Run provider-specific network commands from REFERENCE.md for $PROVIDER
echo "[+] Network security review written to $NET_OUT"

Step 6: Generate findings report

echo "[*] Generating consolidated findings report..."
REPORT="$OUTDIR/cloud_pentest_report_${PROVIDER}_${TIMESTAMP}.txt"

cat > "$REPORT" <<HEADER
=======================================================
  CLOUD SECURITY ASSESSMENT REPORT
  Provider  : $(echo "$PROVIDER" | tr '[:lower:]' '[:upper:]')
  Date      : $(date -u '+%Y-%m-%d %H:%M:%S UTC')
  Scope     : ${SECSKILL_SCOPE:-full assessment}
=======================================================

HEADER

echo "--- 1. IAM FINDINGS ---" >> "$REPORT"
cat "$IAM_OUT" >> "$REPORT" 2>/dev/null

echo "" >> "$REPORT"
echo "--- 2. DATA EXPOSURE FINDINGS ---" >> "$REPORT"
cat "$STORAGE_OUT" >> "$REPORT" 2>/dev/null

echo "" >> "$REPORT"
echo "--- 3. NETWORK SECURITY FINDINGS ---" >> "$REPORT"
cat "$NET_OUT" >> "$REPORT" 2>/dev/null

echo "" >> "$REPORT"
echo "--- 4. AUTOMATED SCAN SUMMARY ---" >> "$REPORT"
echo "ScoutSuite output : $SCOUT_OUT" >> "$REPORT"
echo "Prowler output    : $PROWLER_OUT" >> "$REPORT"

# Privilege escalation paths are documented in REFERENCE.md
echo "" >> "$REPORT"
echo "--- 5. PRIVILEGE ESCALATION PATHS TO REVIEW ---" >> "$REPORT"
echo "See REFERENCE.md for the full privilege escalation paths lookup table (AWS/Azure/GCP)." >> "$REPORT"

echo "[+] Report written to $REPORT"
echo ""
echo "===== Cloud Pentest Assessment Summary ====="
echo "Provider      : $PROVIDER"
echo "IAM analysis  : $IAM_OUT"
echo "Storage check : $STORAGE_OUT"
echo "Network check : $NET_OUT"
echo "Full report   : $REPORT"
echo "============================================="

Done when

• Automated ScoutSuite and Prowler scans complete without authentication errors
• IAM analysis output contains policy and role findings
• Storage exposure check covers all buckets/blobs in scope
• Network security review covers security groups/NSGs/firewall rules
• Consolidated report file is present in $SECSKILL_OUTPUT_DIR

Failure modes

Symptom	Cause	Resolution
credentials invalid	Wrong profile or expired token	Re-authenticate: aws sso login, az login, gcloud auth login
ScoutSuite auth error	Insufficient permissions for audit	Ensure ReadOnly or SecurityAudit policy attached
AccessDenied on S3 API calls	Missing s3:GetBucketPolicy permission	Add explicit read permissions to audit role
Prowler rate-limited	Too many API calls too fast	Add --throttling-retry-attempts 3 flag
gsutil: not found	GCP SDK not installed	Install via gcloud components install gsutil

Notes

• Only run against authorized environments. Cloud API calls leave audit trails in CloudTrail/Activity Log/Cloud Audit Logs.
• For AWS, attaching the managed SecurityAudit policy to the assessment role covers most read operations.
• Use pacu for hands-on AWS exploitation simulation in lab/authorized environments: pip install pacu && pacu.
• CloudMapper (pip install cloudmapper) provides visual AWS network topology: python cloudmapper.py prepare --account $ACCOUNT_ID.
• All IaC remediation examples (Terraform/CloudFormation) should be scoped to least-privilege and reviewed before applying.
• CIS Benchmark violations from Prowler are classified by level (L1 = mandatory, L2 = defense-in-depth).