| name | cloud-pentest |
| description | Multi-cloud CSPM assessment using ScoutSuite/Prowler with IAM privilege escalation, storage exposure, and network posture for AWS/Azure/GCP |
| license | MIT |
| metadata | {"category":"recon","locale":"en","phase":"v1"} |
What this skill does
Performs a structured cloud security assessment across AWS, Azure, and GCP. Runs automated multi-cloud audits with ScoutSuite and Prowler, then performs deep manual analysis of IAM privilege escalation paths, storage exposure, network posture, and serverless configurations. Produces a findings report with CIS benchmark violations, attack narratives, and IaC remediation examples.
When to use
- When performing a cloud security posture assessment (CSPM) against an authorized environment
- When auditing IAM roles and policies for overpermissive grants or privilege escalation paths
- When checking storage buckets/blobs for public exposure or weak access controls
- When reviewing network security groups, NACLs, and VPC endpoint configurations
- When mapping serverless function attack surfaces (Lambda, Azure Functions, Cloud Functions)
Prerequisites
pip install scoutsuite prowler-cloud pacu
Inputs
| Variable | Required | Description |
|---|
SECSKILL_CLOUD_PROVIDER | required | Target provider: aws, azure, or gcp |
AWS_PROFILE | AWS | Named AWS CLI profile to use |
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY | AWS (alt) | Static AWS credentials |
AZURE_SUBSCRIPTION_ID | Azure | Target Azure subscription ID |
GCP_PROJECT_ID | GCP | Target GCP project ID |
SECSKILL_OUTPUT_DIR | optional | Directory for results (default: ./output) |
SECSKILL_SCOPE | optional | Comma-separated services to limit scan scope |
Workflow
Step 1: Identify cloud provider and validate credentials
export PROVIDER="${SECSKILL_CLOUD_PROVIDER:?Set SECSKILL_CLOUD_PROVIDER to aws, azure, or gcp}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
TIMESTAMP=$(date -u '+%Y%m%dT%H%M%SZ')
mkdir -p "$OUTDIR"
case "$PROVIDER" in
aws)
echo "[*] Validating AWS credentials..."
aws sts get-caller-identity || { echo "[-] AWS credentials invalid"; exit 1; }
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
echo "[+] AWS account: $ACCOUNT_ID"
;;
azure)
echo "[*] Validating Azure credentials..."
az account show --subscription "${AZURE_SUBSCRIPTION_ID:?Set AZURE_SUBSCRIPTION_ID}" \
|| { echo "[-] Azure credentials invalid"; exit 1; }
echo "[+] Azure subscription: $AZURE_SUBSCRIPTION_ID"
;;
gcp)
echo "[*] Validating GCP credentials..."
gcloud config set project "${GCP_PROJECT_ID:?Set GCP_PROJECT_ID}"
gcloud auth application-default print-access-token > /dev/null \
|| { echo "[-] GCP credentials invalid"; exit 1; }
echo "[+] GCP project: $GCP_PROJECT_ID"
;;
*)
echo "[-] Unknown provider: $PROVIDER (use aws, azure, or gcp)"
exit 1
;;
esac
echo "[+] Credential validation passed"
Step 2: Run automated assessment (ScoutSuite + Prowler)
echo "[*] Running ScoutSuite automated audit..."
SCOUT_OUT="$OUTDIR/scoutsuite_${PROVIDER}_${TIMESTAMP}"
case "$PROVIDER" in
aws)
python3 -m scout aws --report-dir "$SCOUT_OUT" --no-browser 2>&1 \
| tee "$OUTDIR/scoutsuite_run.log"
;;
azure)
python3 -m scout azure --cli --subscription-id "$AZURE_SUBSCRIPTION_ID" \
--report-dir "$SCOUT_OUT" --no-browser 2>&1 \
| tee "$OUTDIR/scoutsuite_run.log"
;;
gcp)
python3 -m scout gcp --user-account --project "$GCP_PROJECT_ID" \
--report-dir "$SCOUT_OUT" --no-browser 2>&1 \
| tee "$OUTDIR/scoutsuite_run.log"
;;
esac
echo "[*] Running Prowler compliance checks..."
PROWLER_OUT="$OUTDIR/prowler_${PROVIDER}_${TIMESTAMP}"
mkdir -p "$PROWLER_OUT"
case "$PROVIDER" in
aws)
prowler aws --output-directory "$PROWLER_OUT" \
--output-formats json,csv --compliance cis_1.5_aws 2>&1 \
| tail -20
;;
azure)
prowler azure --subscription-id "$AZURE_SUBSCRIPTION_ID" \
--output-directory "$PROWLER_OUT" --output-formats json,csv \
--compliance cis_2.0_azure 2>&1 | tail -20
;;
gcp)
prowler gcp --project-id "$GCP_PROJECT_ID" \
--output-directory "$PROWLER_OUT" --output-formats json,csv \
--compliance cis_2.0_gcp 2>&1 | tail -20
;;
esac
echo "[+] Automated assessment complete"
Step 3: IAM analysis
Reference: See REFERENCE.md for per-provider IAM analysis CLI commands (AWS/Azure/GCP).
echo "[*] Performing IAM analysis..."
IAM_OUT="$OUTDIR/iam_analysis_${TIMESTAMP}.txt"
echo "[+] IAM analysis written to $IAM_OUT"
Step 4: Storage and data exposure check
Reference: See REFERENCE.md for per-provider storage security check commands (AWS S3, Azure Storage/Key Vault, GCP Cloud Storage).
echo "[*] Checking storage and data exposure..."
STORAGE_OUT="$OUTDIR/storage_exposure_${TIMESTAMP}.txt"
echo "[+] Storage exposure check written to $STORAGE_OUT"
Step 5: Network security review
Reference: See REFERENCE.md for per-provider network review commands (AWS security groups/NACLs/IMDSv1/VPC endpoints, Azure NSGs, GCP firewall rules/GKE).
echo "[*] Reviewing network security configuration..."
NET_OUT="$OUTDIR/network_security_${TIMESTAMP}.txt"
echo "[+] Network security review written to $NET_OUT"
Step 6: Generate findings report
echo "[*] Generating consolidated findings report..."
REPORT="$OUTDIR/cloud_pentest_report_${PROVIDER}_${TIMESTAMP}.txt"
cat > "$REPORT" <<HEADER
=======================================================
CLOUD SECURITY ASSESSMENT REPORT
Provider : $(echo "$PROVIDER" | tr '[:lower:]' '[:upper:]')
Date : $(date -u '+%Y-%m-%d %H:%M:%S UTC')
Scope : ${SECSKILL_SCOPE:-full assessment}
=======================================================
HEADER
echo "--- 1. IAM FINDINGS ---" >> "$REPORT"
cat "$IAM_OUT" >> "$REPORT" 2>/dev/null
echo "" >> "$REPORT"
echo "--- 2. DATA EXPOSURE FINDINGS ---" >> "$REPORT"
cat "$STORAGE_OUT" >> "$REPORT" 2>/dev/null
echo "" >> "$REPORT"
echo "--- 3. NETWORK SECURITY FINDINGS ---" >> "$REPORT"
cat "$NET_OUT" >> "$REPORT" 2>/dev/null
echo "" >> "$REPORT"
echo "--- 4. AUTOMATED SCAN SUMMARY ---" >> "$REPORT"
echo "ScoutSuite output : $SCOUT_OUT" >> "$REPORT"
echo "Prowler output : $PROWLER_OUT" >> "$REPORT"
echo "" >> "$REPORT"
echo "--- 5. PRIVILEGE ESCALATION PATHS TO REVIEW ---" >> "$REPORT"
echo "See REFERENCE.md for the full privilege escalation paths lookup table (AWS/Azure/GCP)." >> "$REPORT"
echo "[+] Report written to $REPORT"
echo ""
echo "===== Cloud Pentest Assessment Summary ====="
echo "Provider : $PROVIDER"
echo "IAM analysis : $IAM_OUT"
echo "Storage check : $STORAGE_OUT"
echo "Network check : $NET_OUT"
echo "Full report : $REPORT"
echo "============================================="
Done when
- Automated ScoutSuite and Prowler scans complete without authentication errors
- IAM analysis output contains policy and role findings
- Storage exposure check covers all buckets/blobs in scope
- Network security review covers security groups/NSGs/firewall rules
- Consolidated report file is present in
$SECSKILL_OUTPUT_DIR
Failure modes
| Symptom | Cause | Resolution |
|---|
credentials invalid | Wrong profile or expired token | Re-authenticate: aws sso login, az login, gcloud auth login |
| ScoutSuite auth error | Insufficient permissions for audit | Ensure ReadOnly or SecurityAudit policy attached |
AccessDenied on S3 API calls | Missing s3:GetBucketPolicy permission | Add explicit read permissions to audit role |
| Prowler rate-limited | Too many API calls too fast | Add --throttling-retry-attempts 3 flag |
gsutil: not found | GCP SDK not installed | Install via gcloud components install gsutil |
Notes
- Only run against authorized environments. Cloud API calls leave audit trails in CloudTrail/Activity Log/Cloud Audit Logs.
- For AWS, attaching the managed
SecurityAudit policy to the assessment role covers most read operations.
- Use
pacu for hands-on AWS exploitation simulation in lab/authorized environments: pip install pacu && pacu.
- CloudMapper (
pip install cloudmapper) provides visual AWS network topology: python cloudmapper.py prepare --account $ACCOUNT_ID.
- All IaC remediation examples (Terraform/CloudFormation) should be scoped to least-privilege and reviewed before applying.
- CIS Benchmark violations from Prowler are classified by level (L1 = mandatory, L2 = defense-in-depth).
