Cloud Security Assessment Checklist

Document all AWS accounts, Azure subscriptions, or GCP projects included in testing.

Ensure compliance with AWS, Azure, or GCP acceptable use policies for security testing.

Request SecurityAudit or Reader role credentials for automated assessment tooling.

Clarify which security controls are the customer's responsibility versus the provider's.

Map all active services to determine the full attack surface.

Check for wildcard (*) actions, resources, and policies granting excessive access.

Verify root account has MFA enabled and is not used for daily operations.

Identify static API keys older than 90 days and service accounts without key rotation.

Review IAM trust policies and external ID requirements for cross-account roles.

Use tools like Pacu or PMapper to identify IAM escalation chains.

Check for custom policies that grant unintended access through service roles.

Scan S3 buckets, Azure Blob containers, and GCS buckets for public read/write access.

Confirm server-side encryption is enabled with appropriate key management (KMS vs. default).

Check for RDS, Azure SQL, or Cloud SQL instances exposed to the internet.

Identify overly permissive bucket policies that could allow unauthorized access.

Review CloudTrail logs, database snapshots, and backup vaults for exposure.

Identify rules allowing 0.0.0.0/0 on sensitive ports (SSH, RDP, databases).

Review network architecture for unintended connectivity between environments.

Verify that Instance Metadata Service v2 is enforced to prevent SSRF-based credential theft.

Check Lambda/Functions execution roles, environment variables, and timeout settings.

Assess EKS/AKS/GKE clusters for privileged containers, RBAC issues, and exposed dashboards.

Confirm CloudTrail, VPC Flow Logs, and GuardDuty or equivalent are enabled and properly configured.

Reference specific CIS control IDs for each identified misconfiguration.

Include Terraform, CloudFormation, or ARM template fixes for each finding.

Visualize how initial access could lead to account-wide compromise.

Suggest CSPM tooling, automated compliance scanning, and guardrail implementations.

Remove test IAM users, security groups, storage objects, and compute instances.