メニュー
Cloud infrastructure misconfiguration hunting for AWS, GCP, and Azure. Use when testing cloud assets, finding exposed S3 buckets, hunting IAM misconfigs, or testing serverless applications.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/oyi77/1ai-skills --skill cloud-hunterコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Android and mobile application security testing — emulators, rooting, traffic interception, dynamic instrumentation. Use when testing mobile apps for vulnerabilities, reversing APKs, or bypassing security controls on Android.
Self-reflection + Self-criticism + Auto-learning from corrections + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when working with self improving.
Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities. Use when working with conducting full scope red team engagement.
SOC 職業分類に基づく
SKILL.md を表示中
| name | cloud-hunter |
| description | Cloud infrastructure misconfiguration hunting for AWS, GCP, and Azure. Use when testing cloud assets, finding exposed S3 buckets, hunting IAM misconfigs, or testing serverless applications. |
| domain | cybersecurity |
| tags | ["aws","azure","cloud","cybersecurity","gcp","hunter","security","testing","money"] |
| subdomain | cloud-security |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["ID.AM-02","PR.AC-03","PR.AC-05","DE.CM-01","DE.CM-07"] |
Cloud infrastructure misconfiguration hunting across AWS, GCP, and Azure. This skill systematically scans cloud environments for exposed storage buckets, overly permissive IAM policies, unsecured security group rules, public-facing databases, Kubernetes RBAC misconfigurations, and serverless function injection points. Uses real Kali Linux cloud auditing tools — Prowler, ScoutSuite, CloudSploit, aws-cli, gcloud, az, kubectl, and custom boto3 enumeration scripts — to map misconfigurations and produce prioritized remediation roadmaps mapped to CIS Cloud Foundations Benchmarks.
Cloud misconfigurations are the #1 cause of data breaches in 2024-2025. A single open S3 bucket or over-privileged IAM role is a direct path to credential theft, data exfiltration, and infrastructure takeover. This skill turns that attack surface into a billable service.
Trigger phrases:
Use when:
Do not use when you lack authorized credentials or signed testing agreement, for production environments without change management approval, when the scope requires regulatory compliance legal review (PCI QSA, HIPAA BA agreement), or when a dedicated cloud security architect is already engaged — overlapping audits waste budget.
Target Buyer: CTOs, DevOps leads, and security managers at startups ($1-20M ARR), SaaS companies, and mid-market enterprises migrating workloads to the cloud. Also: MSPs and cloud consultancies that sub-contract security reviews, and CISOs in regulated industries (fintech, healthtech) needing quarterly posture assessments.
How You Make Money:
Cloud Security Posture Assessment — Run Prowler/ScoutSuite against client AWS/GCP/Azure accounts, produce a CIS-benchmark-mapped report with finding severity, evidence, and step-by-step remediation ($1K-5K/job).
Kubernetes Security Audit — Review EKS/GKE/AKS cluster configurations: RBAC bindings, pod security standards, network policies, secrets management, admission controller setup. Deliver a Kube-bench/Hardeneks report ($1.5K-4K/cluster).
Serverless & CI/CD Pipeline Review — Audit Lambda/Cloud Functions for over-permissioned execution roles, injection vectors, exposed secrets in environment variables, and CI/CD pipeline security (GitHub Actions, GitLab CI, CodePipeline) ($1K-3K/pipeline).
Remediation Implementation — Fix the findings you discovered: lock down buckets, rewrite IAM policies, configure security groups, enable encryption, deploy GuardDuty/Security Command Center/Defender for Cloud ($500-2K per remediation day).
Monthly Cloud Security Monitoring — Recurring monthly scan and report with trend tracking, new-resource auditing, and Slack/Teams alert integration. Retainer model ($500-2K/mo).
| Tier | Price | What They Get |
|---|---|---|
| Basic — Cloud Snapshot Audit | $1,000 | Single-cloud (AWS/GCP/Azure) posture scan with Prowler/ScoutSuite. 10-15 page report covering S3/Cloud Storage/Blob, IAM, security groups, logging. Top 10 critical findings with fix commands. Delivered in 3 business days. |
| Pro — Full Cloud Assessment | $3,500 | Multi-cloud audit (up to 3 accounts/projects). Full CIS benchmark coverage. Includes Kubernetes cluster audit (kube-bench + manual RBAC review), serverless function review, CI/CD pipeline scan. 25-40 page report with executive summary, risk matrix, and prioritized remediation playbook. Includes one 30-minute findings walkthrough call. |
| Enterprise — Managed Cloud Security | $2,000/mo | Monthly full-scope scan across all cloud accounts (up to 10 accounts/projects). Trend tracking dashboard, new-resource alerting, quarterly executive briefing. Includes remediation-as-a-service: up to 8 hours/month implementing fixes (IAM policy rewrite, bucket lockdown, GuardDuty enablement). Slack/Teams integration for real-time finding alerts. Annual penetration test included. |
Expected First Dollar: 2-5 days. Reach out to your existing network of startup founders, join cloud security Slack communities, or post on Upwork/Contra. A single $1K basic audit takes 3-4 hours of scanning + 3-4 hours of report writing once you have the client's cloud credentials.
A complete cloud misconfiguration scanner that runs on Kali Linux against a target AWS account. The script enumerates S3 bucket permissions, IAM roles with administrative access, security group rules with 0.0.0.0/0 ingress, and unencrypted storage — then generates a prioritized finding report.
#!/bin/bash
# cloud-hunter-scan.sh — Cloud Misconfiguration Scanner
# Usage: ./cloud-hunter-scan.sh <aws-profile-name>
# Requires: aws-cli v2, jq, pip3 install prowler
# Targets: AWS S3, IAM, EC2 Security Groups, CloudTrail, KMS
set -euo pipefail
shopt -s inherit_errexit
if [ $# -lt 1 ]; then
echo "Usage: $0 <aws-profile-name>"
echo " ./cloud-hunter-scan.sh my-client-prod"
exit 1
fi
PROFILE="$1"
OUTDIR="cloud-hunt-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$OUTDIR"
echo "[*] Cloud Hunter Scan — Target: ${PROFILE} Output: ${OUTDIR}"
echo ""
# ── Step 1: Verify credentials ──────────────────────────────────────
echo "[1/6] Verifying AWS credentials..."
if ! aws sts get-caller-identity --profile "$PROFILE" &>/dev/null; then
echo "ERROR: Cannot authenticate with profile '${PROFILE}'. Check your credentials."
exit 1
fi
ACCOUNT_ID=$(aws sts get-caller-identity --profile "$PROFILE" --query Account --output text)
echo " Account: ${ACCOUNT_ID}"
echo ""
# ── Step 2: S3 Bucket Audit ─────────────────────────────────────────
echo "[2/6] Scanning S3 buckets for public exposure..."
aws s3api list-buckets --profile "$PROFILE" --query 'Buckets[*].Name' --output text \
| tr '\t' '\n' > "${OUTDIR}/buckets.txt"
>"${OUTDIR}/s3-findings.csv"
while IFS= read -r bucket; do
[ -z "$bucket" ] && continue
# Check public access block
BLOCK=$(aws s3api get-public-access-block --bucket "$bucket" --profile "$PROFILE" 2>/dev/null \
| jq -r 'if .PublicAccessBlockConfiguration.BlockPublicAcls and .PublicAccessBlockConfiguration.BlockPublicPolicy and .PublicAccessBlockConfiguration.IgnorePublicAcls and .PublicAccessBlockConfiguration.RestrictPublicBuckets then "LOCKED" else "UNLOCKED" end' \
|| echo "NO_BLOCK_CONFIG")
# Check bucket ACL
ACL=$(aws s3api get-bucket-acl --bucket "$bucket" --profile "$PROFILE" 2>/dev/null \
| jq -r '[.Grants[] | select(.Grantee.URI == "http://acs.amazonaws.com/groups/global/AllUsers" or .Grantee.URI == "http://acs.amazonaws.com/groups/global/AuthenticatedUsers")] | length' \
|| echo "0")
# Check bucket policy
POLICY=$(aws s3api get-bucket-policy --bucket "$bucket" --profile "$PROFILE" 2>/dev/null \
| jq -r 'if .Policy | fromjson | any(.Statement[]; .Effect == "Allow" and (.Principal == "*" or .Principal.AWS == "*")) then "PUBLIC" else "RESTRICTED" end' \
|| echo "NO_POLICY")
# Check encryption
ENCRYPT=$(aws s3api get-bucket-encryption --bucket "$bucket" --profile "$PROFILE" 2>/dev/null \
| jq -r 'if .ServerSideEncryptionConfiguration.Rules[0].ApplyServerSideEncryptionByDefault.SSEAlgorithm then "ENCRYPTED" else "NO_ENCRYPTION" end' \
|| echo "NO_ENCRYPTION")
SEVERITY="INFO"
[ "$BLOCK" = "UNLOCKED" ] && SEVERITY="HIGH"
[ "$ACL" != "0" ] && SEVERITY="CRITICAL"
[ "$POLICY" = "PUBLIC" ] && SEVERITY="CRITICAL"
[ "$ENCRYPT" = "NO_ENCRYPTION" ] && [ "$SEVERITY" = "INFO" ] && SEVERITY="MEDIUM"
echo "${bucket},${BLOCK},${ACL},${POLICY},${ENCRYPT},${SEVERITY}" >> "${OUTDIR}/s3-findings.csv"
done < "${OUTDIR}/buckets.txt"
S3_HIGH=$(grep -c 'CRITICAL\|HIGH' "${OUTDIR}/s3-findings.csv" || true)
echo " Buckets scanned. Critical/High findings: ${S3_HIGH}"
echo ""
# ── Step 3: IAM Policy Audit ────────────────────────────────────────
echo "[3/6] Auditing IAM policies for over-permissive access..."
aws iam list-users --profile "$PROFILE" --query 'Users[*].UserName' --output text \
| tr '\t' '\n' > "${OUTDIR}/iam-users.txt"
aws iam list-roles --profile "$PROFILE" --query 'Roles[*].RoleName' --output text \
| tr '\t' '\n' > "${OUTDIR}/iam-roles.txt"
# Check for inline policies allowing * on *
>"${OUTDIR}/iam-findings.csv"
for entity_type in user role; do
list_file="${OUTDIR}/iam-${entity_type}s.txt"
while IFS= read -r name; do
[ -z "$name" ] && continue
if [ "$entity_type" = "user" ]; then
POLICIES=$(aws iam list-user-policies --profile "$PROFILE" --user-name "$name" --query 'PolicyNames' --output text 2>/dev/null)
ATTACHED=$(aws iam list-attached-user-policies --profile "$PROFILE" --user-name "$name" --query 'AttachedPolicies[*].PolicyArn' --output text 2>/dev/null)
else
POLICIES=$(aws iam list-role-policies --profile "$PROFILE" --role-name "$name" --query 'PolicyNames' --output text 2>/dev/null)
ATTACHED=$(aws iam list-attached-role-policies --profile "$PROFILE" --role-name "$name" --query 'AttachedPolicies[*].PolicyArn' --output text 2>/dev/null)
fi
IS_ADMIN="false"
for pol_arn in $ATTACHED; do
if echo "$pol_arn" | grep -qi 'AdministratorAccess\|FullAccess'; then
IS_ADMIN="true"
break
fi
done
if [ "$IS_ADMIN" = "true" ]; then
echo "${entity_type},${name},ADMIN_ACCESS" >> "${OUTDIR}/iam-findings.csv"
fi
done < "$list_file"
done
# Access key age audit
aws iam list-access-keys --profile "$PROFILE" --query 'AccessKeyMetadata[?Status==`Active`].[UserName,AccessKeyId,CreateDate]' --output text \
| awk '{age_days=int((systime()-sprintf("%d", mktime(gensub(/[-T:.Z]/," ","g",$3))))/86400); if(age_days>90) print $1","$2","$3","age_days}' \
> "${OUTDIR}/old-access-keys.csv" 2>/dev/null || true
IAM_ADMIN=$(wc -l < "${OUTDIR}/iam-findings.csv" 2>/dev/null || echo "0")
echo " Over-permissioned entities: ${IAM_ADMIN}"
echo ""
# ── Step 4: Security Group Audit ────────────────────────────────────
echo "[4/6] Scanning security groups for wide-open ingress..."
aws ec2 describe-security-groups --profile "$PROFILE" --query 'SecurityGroups[].[GroupId,GroupName,Description, IpPermissions[*].IpRanges[?CidrIp==`0.0.0.0/0`].CidrIp]' --output json \
> "${OUTDIR}/sg-all-open.json" 2>/dev/null
# Summarize open ports
jq -r '.[] | select(.[3] | length > 0) | .[0] + "," + .[1]' "${OUTDIR}/sg-all-open.json" \
> "${OUTDIR}/open-security-groups.csv" 2>/dev/null || true
SG_OPEN=$(wc -l < "${OUTDIR}/open-security-groups.csv" 2>/dev/null || echo "0")
echo " Security groups with 0.0.0.0/0 ingress: ${SG_OPEN}"
echo ""
# ── Step 5: Monitoring & Logging Audit ──────────────────────────────
echo "[5/6] Checking CloudTrail and Config status..."
TRAIL_STATUS=$(aws cloudtrail describe-trails --profile "$PROFILE" --query 'trailList[?IsMultiRegionTrail==`true`].Name' --output text 2>/dev/null)
if [ -z "$TRAIL_STATUS" ]; then
echo " WARNING: No multi-region CloudTrail found" | tee -a "${OUTDIR}/monitoring-findings.txt"
fi
CONFIG_RECORDER=$(aws configservice describe-configuration-recorders --profile "$PROFILE" --query 'ConfigurationRecorders[*].name' --output text 2>/dev/null)
if [ -z "$CONFIG_RECORDER" ]; then
echo " WARNING: No AWS Config recorder enabled" | tee -a "${OUTDIR}/monitoring-findings.txt"
fi
echo ""
# ── Step 6: Prowler CIS Scan (if installed) ─────────────────────────
echo "[6/6] Running Prowler CIS benchmark checks (if available)..."
if command -v prowler &>/dev/null; then
prowler aws --profile "$PROFILE" --output-modes csv --output-filename "${OUTDIR}/prowler-aws" 2>/dev/null \
&& echo " Prowler scan complete." \
|| echo " Prowler scan encountered issues but partial results available."
else
echo " Prowler not installed. Install: pip3 install prowler"
echo " Run manually: prowler aws --profile ${PROFILE}"
fi
echo ""
# ── Report Generation ───────────────────────────────────────────────
echo "=== Generating Summary Report ==="
cat > "${OUTDIR}/cloud-hunt-report.md" <<REPORT
# Cloud Security Posture Report
**Account:** ${ACCOUNT_ID} **Profile:** ${PROFILE} **Date:** $(date)
## Executive Summary
A cloud infrastructure misconfiguration scan was performed against AWS account ${ACCOUNT_ID}.
The scan covered S3 bucket permissions, IAM policy analysis, security group rules,
CloudTrail configuration, and CIS benchmark compliance checks.
## Findings Summary
### CRITICAL / HIGH Severity
- **S3 Buckets:** ${S3_HIGH} buckets with public exposure or missing encryption
- **IAM Over-Permissioning:** ${IAM_ADMIN} users/roles with administrative access
- **Open Security Groups:** ${SG_OPEN} groups allow ingress from 0.0.0.0/0
### S3 Bucket Details
$(column -t -s',' "${OUTDIR}/s3-findings.csv" 2>/dev/null || echo " No S3 data available")
### Security Groups with 0.0.0.0/0
$(cat "${OUTDIR}/open-security-groups.csv" 2>/dev/null || echo " None found")
### Monitoring Findings
$(cat "${OUTDIR}/monitoring-findings.txt" 2>/dev/null || echo " CloudTrail and Config appear configured")
## Next Steps
1. Review all CRITICAL findings immediately — lock exposed S3 buckets, rotate over-permissioned keys
2. Remove 0.0.0.0/0 ingress rules from security groups — use specific IP ranges or VPN
3. Enable S3 Block Public Access at account level
4. Configure AWS Config + CloudTrail if not already enabled
5. Run Prowler full CIS benchmark: \`prowler aws --profile ${PROFILE}\`
6. Schedule monthly follow-up scan to track improvements
REPORT
echo ""
echo "=========================================="
echo " Cloud Hunter Scan Complete!"
echo " Output Directory: ${OUTDIR}/"
echo " Report: ${OUTDIR}/cloud-hunt-report.md"
echo " S3 Findings: ${OUTDIR}/s3-findings.csv"
echo " IAM Findings: ${OUTDIR}/iam-findings.csv"
echo " Open SGs: ${OUTDIR}/open-security-groups.csv"
echo "=========================================="
What this script produces: A timestamped output directory with a Markdown executive report, CSV findings per cloud resource category, IAM audit data, and Prowler CIS benchmark results (if installed). Total runtime: 5-15 minutes depending on account size.
Extending for GCP/Azure: Replace the AWS CLI calls with gcloud equivalents (e.g. gcloud storage buckets list, gcloud iam roles list, gcloud compute firewall-rules list) and az equivalents (e.g. az storage account list, az role assignment list, az network nsg list). The report generation and severity scoring logic stays the same.
The client receives a Cloud Security Posture Report delivered as a branded PDF (Markdown → pandoc) and a raw CSV data pack for their compliance team.
# Cloud Security Posture Report — ACME Corp
**Prepared by:** [Your Name / Company]
**Date:** $(date +%Y-%m-%d)
**Scope:** AWS Production Account (acct-1234-5678), GCP Production (proj-acme-prod)
**Engagement Type:** CIS Foundations Benchmark Audit
**Classification:** CONFIDENTIAL
---
## 1. Executive Summary
ACME Corp's cloud infrastructure was assessed against the CIS AWS Foundations
Benchmark v3.0 and CIS GCP Foundations Benchmark v2.0. Of 86 checks performed:
| Severity | Count | % of Total |
|------------|-------|------------|
| Critical | 3 | 3.5% |
| High | 12 | 14.0% |
| Medium | 28 | 32.6% |
| Low | 19 | 22.1% |
| Pass | 24 | 27.9% |
**Critical Findings:**
1. S3 bucket `acme-backups-prod` is publicly readable (CIS 2.1.1)
2. IAM user `ci-deploy-bot` has AdministratorAccess (CIS 1.16)
3. Security group `sg-prod-web-db` allows 0.0.0.0/0 on port 5432 (CIS 4.1)
---
## 2. Methodology
The assessment used automated scanning tools and manual review:
- **Prowler** — 86 CIS AWS Foundations Benchmark checks
- **ScoutSuite** — Multi-cloud resource enumeration and risk scoring
- **AWS CLI / boto3** — Custom enumeration scripts for IAM, S3, EC2, CloudTrail
- **gcloud CLI** — GCP IAM, Cloud Storage, Firewall, Logging audit
- **kube-bench** — Kubernetes CIS Benchmark (if applicable)
- **Trivy** — Container image vulnerability scan (if applicable)
---
## 3. Detailed Findings
### 3.1 S3 Bucket ACME-BACKUPS-PROD — CRITICAL
- **Check:** CIS 2.1.1 — S3 bucket ACL allows public READ access
- **Evidence:** \`aws s3api get-bucket-acl --bucket acme-backups-prod\`
returns AllUsers group with READ permission
- **Risk:** Any internet user can list and download all backup files
(database dumps, config files, customer PII)
- **Remediation:**
\`\`\`bash
aws s3api put-public-access-block --bucket acme-backups-prod \
--public-access-block-configuration \
BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
# Then review and remove public ACL grants:
aws s3api put-bucket-acl --bucket acme-backups-prod --acl private
\`\`\`
- **CIS Reference:** 2.1.1 (Ensure S3 Bucket Policy Restricts Public Access)
- **CVE/NIST:** T1530 (Data from Cloud Storage)
### 3.2 IAM User CI-DEPLOY-BOT — CRITICAL
- **Check:** CIS 1.16 — IAM policy attached with "Effect": "Allow", "Action": "*"
- **Risk:** Compromise of CI/CD credentials leads to full account takeover
- **Remediation:**
\`\`\`bash
# Create scoped deployment policy
aws iam create-policy --policy-name ci-deploy-restricted \
--policy-document file://ci-deploy-policy.json
# Detach admin, attach scoped
aws iam detach-user-policy --user-name ci-deploy-bot \
--policy-arn arn:aws:iam::aws:policy/AdministratorAccess
aws iam attach-user-policy --user-name ci-deploy-bot \
--policy-arn arn:aws:iam::ACCT_ID:policy/ci-deploy-restricted
# Rotate access keys
aws iam create-access-key --user-name ci-deploy-bot
\`\`\`
### 3.3 Security Group SG-PROD-WEB-DB — CRITICAL
- **Check:** CIS 4.1 — Security group allows unrestricted ingress on port 5432
- **Risk:** Direct PostgreSQL access from the internet enables brute-force
and data exfiltration
- **Remediation:**
\`\`\`bash
# Revoke the 0.0.0.0/0 rule, replace with app-tier CIDR
aws ec2 revoke-security-group-ingress --group-id sg-xxx \
--protocol tcp --port 5432 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id sg-xxx \
--protocol tcp --port 5432 --cidr 10.1.0.0/16
\`\`\`
---
## 4. Kubernetes Security Assessment (if applicable)
| Check | Status | Finding |
|-------|--------|---------|
| RBAC bindings with cluster-admin | FAIL | User \`deployer\` has cluster-admin |
| Pod Security Standards | FAIL | Default namespace allows privileged |
| Network Policies | FAIL | No network policies — flat pod network |
| Secrets not encrypted at rest | PASS | etcd encryption enabled |
| kube-bench score | 62/100 | See appendix for failed controls |
---
## 5. Prioritized Remediation Roadmap
**Immediate (24-48 hours):** Fix all CRITICAL findings
- Lock public S3 buckets
- Remove 0.0.0.0/0 ingress rules
- Detach overly permissive IAM policies
- Rotate exposed credentials
**Short-term (1-2 weeks):** Fix all HIGH findings
- Enable S3 Block Public Access at account level
- Enable CloudTrail and AWS Config across all regions
- Configure VPC Flow Logs
- Implement KMS encryption on all storage
- Enforce Pod Security Standards in Kubernetes
**Medium-term (1-3 months):** Fix MEDIUM findings
- Implement IAM permission boundaries
- Enable AWS GuardDuty / GCP Security Command Center / Azure Defender
- Deploy network policies in Kubernetes
- Set up automated compliance scanning (CI/CD pipeline integration)
---
## 6. Tools Used
| Tool | Version | Purpose |
|------|---------|---------|
| Prowler | 4.x | CIS AWS Foundations Benchmark |
| ScoutSuite | 5.x | Multi-cloud resource enumeration |
| AWS CLI | 2.x | S3, IAM, EC2, CloudTrail auditing |
| gcloud CLI | 474+ | GCP IAM, Storage, Firewall audit |
| Azure CLI | 2.x | Azure RBAC, Storage, NSG audit |
| kube-bench | 0.9+ | Kubernetes CIS Benchmark |
| kubectl | 1.28+ | Manual RBAC and pod security review |
| jq | 1.7 | JSON parsing and data extraction |
---
## 7. Appendix: CIS Benchmark Mapping
Full CIS control mapping with pass/fail per check available in:
\`\`\`
attachments/cis-mapping-ACCT1234-5678.csv
\`\`\`
Key CIS controls assessed:
- CIS AWS Foundations Benchmark v3.0 — Sections 1 (IAM), 2 (S3), 3 (Logging),
4 (Networking), 5 (CIS), 6 (Compute)
- CIS GCP Foundations Benchmark v2.0 — Sections 1 (IAM), 2 (Logging),
3 (Networking), 4 (VM), 5 (Storage), 6 (Kubernetes)
- CIS Azure Foundations Benchmark v2.0 — Sections 1 (IAM), 2 (Storage),
3 (Networking), 4 (Compute), 5 (Logging), 6 (Kubernetes)
---
*Report generated by Cloud Hunter. Findings should be validated and prioritized
based on ACME Corp's specific threat model and risk appetite.*
# Example: Check if an S3 bucket is publicly accessible
BUCKET="target-bucket-name"
aws s3api get-bucket-acl --bucket "$BUCKET" --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]'
Prepare Scope and Credentials — Define which cloud accounts, regions, and services are in scope. Obtain read-only cross-account IAM role ARN or service account key. Verify access with aws sts get-caller-identity / gcloud auth list / az account show.
Automated Scanning — Run Prowler for AWS CIS benchmarks, ScoutSuite for multi-cloud resource inventory, and custom aws-cli/gcloud/az scripts for targeted enum. Parallelize independent cloud accounts.
Manual Review and Validation — Review automated findings for false positives. Manually inspect IAM policy documents, S3 bucket policies, Kubernetes RBAC YAML, and serverless function code for business-logic-specific misconfigurations.
Risk Prioritization — Classify findings by severity (CVSS-based), impact blast radius, and ease of exploitation. Map to CIS benchmark control IDs for compliance reporting.
Remediation Playbook Generation — For each finding, write the exact CLI commands or Terraform HCL needed to fix it. Include rollback steps.
Report Delivery — Generate PDF report via pandoc from Markdown template. Include executive summary, detailed findings, CIS mapping, fix commands, and prioritized roadmap. Deliver CSV raw data for client compliance team.
pip3 install prowlerpip3 install scoutsuitecurl -L https://github.com/aquasecurity/kube-bench/releases/...apt install trivy or pip3 install trivys3api, iam, ec2, cloudtrail, configservice, lambda, eks)storage, iam, compute, logging, container, functions)az storage account, az role assignment, az network nsg, az aks)get roles, get clusterrolebindings, get networkpolicies, get podsecuritypolicies)pip3 install checkovapt install tfsec or go install github.com/aquasecurity/tfsec/cmd/tfsec@latestCloud Reconnaissance — Enumerate all resources across targeted cloud providers: storage buckets, compute instances, IAM principals, security group rules, Kubernetes clusters, serverless functions, load balancers, DNS zones, certificate managers, API gateways.
Misconfiguration Analysis — Execute CIS benchmark checks via Prowler (AWS), ScoutSuite (multi-cloud), kube-bench (K8s). Manually review IAM policy documents for privilege escalation paths (CloudSplaining, Principal Mapper). Audit S3/Cloud Storage/Blob for public access, unencrypted data, and missing versioning.
Vulnerability Correlation — Cross-reference misconfigurations with known CVE/exploit paths. Example: an open S3 bucket containing Lambda source code ZIP reveals hardcoded API keys → cloud account takeover chain. Document each attack path with evidence.
Remediation Scripting — Write automated fix scripts (bash/CLI one-liners, Terraform modules, CloudFormation templates) per finding. Include validation steps to confirm the fix.
Reporting and Handoff — Generate final report with executive summary (non-technical), technical findings with evidence, CIS benchmark mapping, severity-rated remediation roadmap, and raw data exports for compliance auditors.
| Rationalization | Reality |
|---|---|
| "The cloud provider secures everything — it's their responsibility." | AWS/GCP/Azure operate on a Shared Responsibility Model. The provider secures the cloud; you secure what's in the cloud. S3 buckets, IAM policies, security groups, and Kubernetes RBAC are 100% your responsibility. A customer-side misconfiguration is the #1 source of cloud breaches. |
| "We use default settings — those must be secure." | Default settings prioritize convenience over security. Default VPCs allow all outbound traffic, default S3 Block Public Access is off in many regions, default service accounts in GCP are over-permissioned, and default Kubernetes namespaces allow privileged pods. Default = insecure until proven otherwise. |
| "Nobody will find our buckets — they don't have the URL." | Attackers discover buckets through automated scanning of DNS, Certificate Transparency logs, and GitHub. Shodan and Grayhat Warfare index open buckets continuously. A bucket name is not a security boundary. |
| "We only use CloudTrail — we'll see any attack." | CloudTrail only logs API calls. It does not block, alert, or prevent misconfigurations. Without GuardDuty, Config Rules, and real-time anomaly detection, a bucket opened to the world stays open until the breach bill arrives. |
| "Our IAM is fine — we only gave admin to the CI/CD bot." | A CI/CD pipeline credential with AdministratorAccess is a single point of total compromise. If the CI/CD server is breached, the attacker owns the entire AWS account. Use scoped IAM roles with resource-level permissions and short-lived credentials from AWS STS. |
| "Kubernetes RBAC is too complex to audit — we'll do it later." | A single over-permissioned ClusterRoleBinding grants cluster-admin to any pod. Combined with a compromised container image, the attacker controls all nodes, all namespaces, and all secrets. RBAC takes 30 minutes to audit with kubectl get clusterrolebindings but months to recover from a cluster compromise. |
| "We encrypt everything at rest — that's enough." | Encryption at rest protects data only when the storage is offline. A publicly readable but encrypted S3 bucket still exposes all object metadata, filenames, and directory structure. An attacker with read access can download your encrypted files and brute-force the encryption key offline. Encryption complements access control — it does not replace it. |
| "We passed a SOC 2 audit — we're secure in the cloud." | SOC 2 Type II certifies that controls exist and operated as described for a specific period. It does not certify absolving of all risk. Many SOC 2-compliant companies have suffered cloud breaches because their audit scope omitted certain services, regions, or IAM permissions. Cloud security is continuous, not point-in-time. |
| "Our cloud bill is only $500/month — we're not a target." | Cloud account takeover is automated and opportunistic, not targeted. Crypto-mining botnets scan for exposed AWS keys continuously. A $500/month account can incur $50,000 in crypto-mining charges in a single weekend. Small accounts are preferred targets because they lack monitoring. |