cloud-audit

Name: cloud-audit
Author: briiirussell

320stars36forks

How to install cloud-audit?

briiirussell/cybersecurity-skills/cloud-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill cloud-audit

Installs into the current project.

Summary

Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps. Use when the user mentions 'cloud security,' 'cloud audit,' 'AWS security,' 'GCP security,' 'Azure security,' 'IAM audit,' 'S3 bucket,' 'cloud misconfiguration,' 'cloud h

Files · 1

View on GitHub

SKILL.md

1	# Cloud Audit — Cloud Infrastructure Security Review
2
3	Audit cloud infrastructure configurations for misconfigurations, excessive permissions, public exposure, and compliance gaps. Covers AWS, GCP, and Azure.
4
5	Cross-references: `iam-audit` for the consultant-style IAM deep-dive (design / audit / migrate across identity providers and federation patterns) — this skill includes an IAM section but stays at the cloud-posture level; for role design, JIT access, workload identity federation, and migration plans, invoke `iam-audit`. `container-audit` for Kubernetes-specific posture sitting on top of cloud. `secrets-audit` for secrets-manager hygiene and rotation.
6
7	Findings should use the three-disposition rule (Fixed / Deferred / Accepted Risk) per `owasp-audit`'s Report Format.
8
9	## Scope the Audit
10
11	Identify:
12	1. Cloud provider(s) and account(s)
13	2. Regions in use
14	3. Whether CLI tools are available (`aws`, `gcloud`, `az`) or reviewing IaC files (Terraform, CloudFormation, Pulumi)
15
16	## Audit Categories
17
18	### Identity and Access Management
19
20	AWS:
21	```bash
22	aws iam get-account-summary
23	aws iam list-users
24	aws iam generate-credential-report && aws iam get-credential-report --output text --query Content \| base64 -d
25	```
26	Check for: root account usage without MFA, access keys older than 90 days, unused credentials, wildcard permissions (`"Action": "*"`), overprivileged roles.
27
28	GCP:
29	```bash
30	gcloud projects get-iam-policy $PROJECT_ID
31	gcloud iam service-accounts list
32	```
33	Check for: primitive roles (Owner/Editor) on too many principals, unused service accounts, service account keys instead of workload identity.
34
35	Azure:
36	```bash
37	az role assignment list --all
38	az ad user list
39	```
40	Check for: excessive Owner/Contributor assignments, guest users with high privileges.
41
42	IaC review: Grep Terraform/CloudFormation files for `"Action": ""`, `"Resource": ""`, hardcoded secrets, overly broad trust policies.
43
44	### Network Security
45
46	Check for:
47	- Security groups or firewall rules allowing `0.0.0.0/0` ingress
48	- Unrestricted SSH (port 22) or RDP (port 3389) from the internet
49	- VPC flow logs disabled
50	- Databases in public subnets
51	- Missing network segmentation between tiers
52
53	### Storage
54
55	AWS S3:
56	```bash
57	aws s3api list-buckets
58	aws s3api get-public-access-block --bucket <name>
59	aws s3api get-bucket-policy --bucket <name>
60	aws s3api get-bucket-encryption --bucket <name>
61	```
62	Check for: public buckets, missing encryption, no versioning, no lifecycle policies, overly permissive bucket policies.
63
64	GCP/Azure: Equivalent checks for Cloud Storage and Blob Storage — look for `allUsers`/`allAuthenticatedUsers` access or anonymous blob access.
65
66	### Compute
67
68	- IMDSv2 enforced? (AWS: `HttpTokens = required`)
69	- Unencrypted EBS volumes or disks
70	- Public IP addresses on instances that don't need them
71	- Outdated AMIs or images (check patch age)
72	- Privileged containers, missing security contexts in Kubernetes
73
74	### Logging and Monitoring
75
76	- CloudTrail / Cloud Audit Logs / Activity Log enabled in all regions
77	- Log storage: encrypted, immutable, adequate retention
78	- GuardDuty / Security Command Center / Defender for Cloud enabled
79	- Alerting configured for: root login, IAM changes, security group changes, large data transfers
80	- VPC Flow Logs and DNS query logs enabled
81
82	### Secrets Management
83
84	- Hardcoded secrets in source code, environment variables, or IaC files
85	- Secrets Manager / Key Vault usage for sensitive values
86	- KMS key rotation configured
87
88	## Output Format
89
90	```markdown
91	# Cloud Security Audit Report
92	## Account(s): [account ID(s)]
93	## Provider: [AWS/GCP/Azure]
94	## Regions: [audited regions]
95	## Date: [date]
96
97	### Summary
98	- Total findings: X
99	- Critical: X \| High: X \| Medium: X \| Low: X
100
101	### Findings
102
103	#### [SEVERITY] [Category]: [Title]
104	Resource: [resource ARN/ID]
105	Region: [region]
106
107	Issue: [What the misconfiguration is]
108
109	Risk: [What an attacker could do]
110
111	Evidence: [CLI output or IaC snippet]
112
113	Remediation: [Specific fix command or IaC change]
114
115	---
116
117	### Prioritized Action Plan
118	1. [Critical — immediate]
119	2. [High — this week]
120	3. [Medium — this month]
121	4. [Low — next quarter]
122	```
123
124	## Boundaries
125
126	- Only audit accounts or projects the user has access to
127	- Do not attempt to access other accounts or tenants
128	- Provide remediation for every finding
129	- Note if a fix might impact availability (e.g., tightening a security group could break connectivity)
130	- Flag any evidence of active compromise found during the audit
131	- Refuse requests to exploit found misconfigurations on others' infrastructure
132
133	## References
134
135	- CIS Ben

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# Cloud Audit — Cloud Infrastructure Security Review

Audit cloud infrastructure configurations for misconfigurations, excessive permissions, public exposure, and compliance gaps. Covers AWS, GCP, and Azure.

Cross-references: `iam-audit` for the consultant-style IAM deep-dive (design / audit / migrate across identity providers and federation patterns) — this skill i

Findings should use the three-disposition rule (Fixed / Deferred / Accepted Risk) per `owasp-audit`'s Report Format.

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type

cloud-audit

320stars36forks

View on GitHub

How to install cloud-audit?

briiirussell/cybersecurity-skills/cloud-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill cloud-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Cloud Audit — Cloud Infrastructure Security Review
2
3	Audit cloud infrastructure configurations for misconfigurations, excessive permissions, public exposure, and compliance gaps. Covers AWS, GCP, and Azure.
4
5	Cross-references: `iam-audit` for the consultant-style IAM deep-dive (design / audit / migrate across identity providers and federation patterns) — this skill includes an IAM section but stays at the cloud-posture level; for role design, JIT access, workload identity federation, and migration plans, invoke `iam-audit`. `container-audit` for Kubernetes-specific posture sitting on top of cloud. `secrets-audit` for secrets-manager hygiene and rotation.
6
7	Findings should use the three-disposition rule (Fixed / Deferred / Accepted Risk) per `owasp-audit`'s Report Format.
8
9	## Scope the Audit
10
11	Identify:
12	1. Cloud provider(s) and account(s)
13	2. Regions in use
14	3. Whether CLI tools are available (`aws`, `gcloud`, `az`) or reviewing IaC files (Terraform, CloudFormation, Pulumi)
15
16	## Audit Categories
17
18	### Identity and Access Management
19
20	AWS:
21	```bash
22	aws iam get-account-summary
23	aws iam list-users
24	aws iam generate-credential-report && aws iam get-credential-report --output text --query Content \| base64 -d
25	```
26	Check for: root account usage without MFA, access keys older than 90 days, unused credentials, wildcard permissions (`"Action": "*"`), overprivileged roles.
27
28	GCP:
29	```bash
30	gcloud projects get-iam-policy $PROJECT_ID
31	gcloud iam service-accounts list
32	```
33	Check for: primitive roles (Owner/Editor) on too many principals, unused service accounts, service account keys instead of workload identity.
34
35	Azure:
36	```bash
37	az role assignment list --all
38	az ad user list
39	```
40	Check for: excessive Owner/Contributor assignments, guest users with high privileges.
41
42	IaC review: Grep Terraform/CloudFormation files for `"Action": ""`, `"Resource": ""`, hardcoded secrets, overly broad trust policies.
43
44	### Network Security
45
46	Check for:
47	- Security groups or firewall rules allowing `0.0.0.0/0` ingress
48	- Unrestricted SSH (port 22) or RDP (port 3389) from the internet
49	- VPC flow logs disabled
50	- Databases in public subnets
51	- Missing network segmentation between tiers
52
53	### Storage
54
55	AWS S3:
56	```bash
57	aws s3api list-buckets
58	aws s3api get-public-access-block --bucket <name>
59	aws s3api get-bucket-policy --bucket <name>
60	aws s3api get-bucket-encryption --bucket <name>
61	```
62	Check for: public buckets, missing encryption, no versioning, no lifecycle policies, overly permissive bucket policies.
63
64	GCP/Azure: Equivalent checks for Cloud Storage and Blob Storage — look for `allUsers`/`allAuthenticatedUsers` access or anonymous blob access.
65
66	### Compute
67
68	- IMDSv2 enforced? (AWS: `HttpTokens = required`)
69	- Unencrypted EBS volumes or disks
70	- Public IP addresses on instances that don't need them
71	- Outdated AMIs or images (check patch age)
72	- Privileged containers, missing security contexts in Kubernetes
73
74	### Logging and Monitoring
75
76	- CloudTrail / Cloud Audit Logs / Activity Log enabled in all regions
77	- Log storage: encrypted, immutable, adequate retention
78	- GuardDuty / Security Command Center / Defender for Cloud enabled
79	- Alerting configured for: root login, IAM changes, security group changes, large data transfers
80	- VPC Flow Logs and DNS query logs enabled
81
82	### Secrets Management
83
84	- Hardcoded secrets in source code, environment variables, or IaC files
85	- Secrets Manager / Key Vault usage for sensitive values
86	- KMS key rotation configured
87
88	## Output Format
89
90	```markdown
91	# Cloud Security Audit Report
92	## Account(s): [account ID(s)]
93	## Provider: [AWS/GCP/Azure]
94	## Regions: [audited regions]
95	## Date: [date]
96
97	### Summary
98	- Total findings: X
99	- Critical: X \| High: X \| Medium: X \| Low: X
100
101	### Findings
102
103	#### [SEVERITY] [Category]: [Title]
104	Resource: [resource ARN/ID]
105	Region: [region]
106
107	Issue: [What the misconfiguration is]
108
109	Risk: [What an attacker could do]
110
111	Evidence: [CLI output or IaC snippet]
112
113	Remediation: [Specific fix command or IaC change]
114
115	---
116
117	### Prioritized Action Plan
118	1. [Critical — immediate]
119	2. [High — this week]
120	3. [Medium — this month]
121	4. [Low — next quarter]
122	```
123
124	## Boundaries
125
126	- Only audit accounts or projects the user has access to
127	- Do not attempt to access other accounts or tenants
128	- Provide remediation for every finding
129	- Note if a fix might impact availability (e.g., tightening a security group could break connectivity)
130	- Flag any evidence of active compromise found during the audit
131	- Refuse requests to exploit found misconfigurations on others' infrastructure
132
133	## References
134
135	- CIS Ben

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# Cloud Audit — Cloud Infrastructure Security Review

Audit cloud infrastructure configurations for misconfigurations, excessive permissions, public exposure, and compliance gaps. Covers AWS, GCP, and Azure.

Cross-references: `iam-audit` for the consultant-style IAM deep-dive (design / audit / migrate across identity providers and federation patterns) — this skill i

Findings should use the three-disposition rule (Fixed / Deferred / Accepted Risk) per `owasp-audit`'s Report Format.

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type