cloud-pentest

What this skill does

Performs a structured cloud security assessment across AWS, Azure, and GCP. Runs automated multi-cloud audits with ScoutSuite and Prowler, then performs deep manual analysis of IAM privilege escalation paths, storage exposure, network posture, and serverless configurations. Produces a findings report with CIS benchmark violations, attack narratives, and IaC remediation examples.

When to use

• When performing a cloud security posture assessment (CSPM) against an authorized environment
• When auditing IAM roles and policies for overpermissive grants or privilege escalation paths
• When checking storage buckets/blobs for public exposure or weak access controls
• When reviewing network security groups, NACLs, and VPC endpoint configurations
• When mapping serverless function attack surfaces (Lambda, Azure Functions, Cloud Functions)

Prerequisites

pip install scoutsuite prowler-cloud pacu
# ScoutSuite also requires cloud provider CLIs:
# AWS CLI:   pip install awscli
# Azure CLI: https://learn.microsoft.com/cli/azure/install-azure-cli
# gcloud:    https://cloud.google.com/sdk/docs/install

Inputs

Variable	Required	Description
SECSKILL_CLOUD_PROVIDER	required	Target provider: aws, azure, or gcp
AWS_PROFILE	AWS	Named AWS CLI profile to use
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY	AWS (alt)	Static AWS credentials
AZURE_SUBSCRIPTION_ID	Azure	Target Azure subscription ID
GCP_PROJECT_ID	GCP	Target GCP project ID
SECSKILL_OUTPUT_DIR	optional	Directory for results (default: ./output)
SECSKILL_SCOPE	optional	Comma-separated services to limit scan scope

Workflow

Step 1: Identify cloud provider and validate credentials

export PROVIDER="${SECSKILL_CLOUD_PROVIDER:?Set SECSKILL_CLOUD_PROVIDER to aws, azure, or gcp}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
TIMESTAMP=$(date -u '+%Y%m%dT%H%M%SZ')
mkdir -p "$OUTDIR"

case "$PROVIDER" in
  aws)
    echo "[*] Validating AWS credentials..."
    aws sts get-caller-identity || { echo "[-] AWS credentials invalid"; exit 1; }
    ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
    echo "[+] AWS account: $ACCOUNT_ID"
    ;;
  azure)
    echo "[*] Validating Azure credentials..."
    az account show --subscription "${AZURE_SUBSCRIPTION_ID:?Set AZURE_SUBSCRIPTION_ID}" \
      || { echo "[-] Azure credentials invalid"; exit 1; }
    echo "[+] Azure subscription: $AZURE_SUBSCRIPTION_ID"
    ;;
  gcp)
    echo "[*] Validating GCP credentials..."
    gcloud config set project "${GCP_PROJECT_ID:?Set GCP_PROJECT_ID}"
    gcloud auth application-default print-access-token > /dev/null \
      || { echo "[-] GCP credentials invalid"; exit 1; }
    echo "[+] GCP project: $GCP_PROJECT_ID"
    ;;
  *)
    echo "[-] Unknown provider: $PROVIDER (use aws, azure, or gcp)"
    exit 1
    ;;
esac

echo "[+] Credential validation passed"