cloud-pentest

---
name: cloud-pentest
description: Multi-cloud CSPM assessment using ScoutSuite/Prowler with IAM privilege escalation, storage exposure, and network posture for AWS/Azure/GCP
license: MIT
---

## What this skill does

Performs a structured cloud security assessment across AWS, Azure, and GCP. Runs automated multi-cloud audits with ScoutSuite and Prowler, then performs deep manual analysis of IAM privilege escalation paths, storage exposure, network posture, and serverless configurations. Produces a findings report with CIS benchmark violations, attack narratives, and IaC remediation examples.

## When to use

- When performing a cloud security posture assessment (CSPM) against an authorized environment
- When auditing IAM roles and policies for overpermissive grants or privilege escalation paths
- When checking storage buckets/blobs for public exposure or weak access controls
- When reviewing network security groups, NACLs, and VPC endpoint configurations
- When mapping serverless function attack surfaces (Lambda, Azure Functions, Cloud Functions)

## Prerequisites

```bash
pip install scoutsuite prowler-cloud pacu
# ScoutSuite also requires cloud provider CLIs:
# AWS CLI:   pip install awscli
# Azure CLI: https://learn.microsoft.com/cli/azure/install-azure-cli
# gcloud:    https://cloud.google.com/sdk/docs/install
```

## Inputs

| Variable | Required | Description |
|----------|----------|-------------|
| `SECSKILL_CLOUD_PROVIDER` | required | Target provider: `aws`, `azure`, or `gcp` |
| `AWS_PROFILE` | AWS | Named AWS CLI profile to use |
| `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` | AWS (alt) | Static AWS credentials |
| `AZURE_SUBSCRIPTION_ID` | Azure | Target Azure subscription ID |
| `GCP_PROJECT_ID` | GCP | Target GCP project ID |
| `SECSKILL_OUTPUT_DIR` | optional | Directory for results (default: `./output`) |
| `SECSKILL_SCOPE` | optional | Comma-separated services to limit scan scope |

## Workflow

### Step 1: Identify cloud provider and validate credentials

```bash
export PROVIDER="${SECSKILL_CLOUD_PROVIDER:?Set SECSKILL_CLOUD_PROVIDER to aws, azure, or gcp}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
TIMESTAMP=$(date -u '+%Y%m%dT%H%M%SZ')
mkdir -p "$OUTDIR"

case "$PROVIDER" in
  aws)
    echo "[*] Validating AWS credentials..."
    aws sts get-caller-identity || { echo "[-] AWS credentials invalid"; exit 1; }
    ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
    echo "[+] AWS account: $ACCOUNT_ID"
    ;;
  azure)
    echo "[*] Validating Azure credentials..."
    az account show --subscription "${AZURE_SUBSCRIPTION_ID:?Set AZURE_SUBSCRIPTION_ID}" \
      || { echo "[-] Azure credentials invalid"; exit 1; }
    echo "[+] Azure subscription: $AZURE_SUBSCRIPTION_ID"
    ;;
  gcp)
    echo "[*] Validating GCP credentials..."
    gcloud config set project "${GCP_PROJECT_ID:?Set GCP_PROJECT_ID}"
    gcloud auth application-default print-access-token > /dev/null \
      || { echo "[-] GCP credentials invalid"; exit 1; }
    echo "[+] GCP project: $GCP_PROJECT_ID"
    ;;
  *)
    echo "[-] Unknown provider: $PROVIDER (use aws, azure, or gcp)"
    exit 1
    ;;
esac

echo "[+] Credential validation passed"
```

### Step 2: Run automated assessment (ScoutSuite + Prowler)

```bash
echo "[*] Running ScoutSuite automated audit..."
SCOUT_OUT="$OUTDIR/scoutsuite_${PROVIDER}_${TIMESTAMP}"

case "$PROVIDER" in
  aws)
    python3 -m scout aws --report-dir "$SCOUT_OUT" --no-browser 2>&1 \
      | tee "$OUTDIR/scoutsuite_run.log"
    ;;
  azure)
    python3 -m scout azure --cli --subscription-id "$AZURE_SUBSCRIPTION_ID" \
      --report-dir "$SCOUT_OUT" --no-browser 2>&1 \
      | tee "$OUTDIR/scoutsuite_run.log"
    ;;
  gcp)
    python3 -m scout gcp --user-account --project "$GCP_PROJECT_ID" \
      --report-dir "$SCOUT_OUT" --no-browser 2>&1 \
      | tee "$OUTDIR/scoutsuite_run.log"
    ;;
esac

echo "[*] Running Prowler compliance checks..."
PROWLER_OUT="$OUTDIR/prowler_${PROVIDER}_${TIMESTAMP}"
mkdir -p "$PROWLER_OUT"

case "$PROVIDER" in
  aws)
    prowler aws --output-directory "$PROWLER_OUT" \
      --output-formats json,csv --compliance cis_1.5_aws 2>&1 \
      | tail -20
    ;;
  azure)
    prowler azure --subscription-id "$AZURE_SUBSCRIPTION_ID" \
      --output-directory "$PROWLER_OUT" --output-formats json,csv \
      --compliance cis_2.0_azure 2>&1 | tail -20
    ;;
  gcp)
    prowler gcp --project-id "$GCP_PROJECT_ID" \
      --output-directory "$PROWLER_OUT" --output-formats json,csv \
      --compliance cis_2.0_gcp 2>&1 | tail -20
    ;;
esac

echo "[+] Automated assessment complete"
```

### Step 3: IAM analysis

> **Reference**: See [REFERENCE.md](REFERENCE.md) for per-provider IAM analysis CLI commands (AWS/Azure/GCP).

```bash
echo "[*] Performing IAM analysis..."
IAM_OUT="$OUTDIR/iam_analysis_${TIMESTAMP}.txt"
# Run provider-specific IAM commands from REFERENCE.md for $PROVIDER
echo "[+] IAM analysis written to $IAM_OUT"
```

### Step 4: Storage and data exposure check

> **Reference**: See [REFERENCE.md](REFERENCE.md) for per-provider storage security check commands (AWS S3, Azure Storage/Key Vault, GCP Cloud Storage).

```bash
echo "[*] Checking storage and data exposure..."
STORAGE_OUT="$OUTDIR/storage_exposure_${TIMESTAMP}.txt"
# Run provider-specific storage commands from REFERENCE.md for $PROVIDER
echo "[+] Storage exposure check written to $STORAGE_OUT"
```

### Step 5: Network security review

> **Reference**: See [REFERENCE.md](REFERENCE.md) for per-provider network review commands (AWS security groups/NACLs/IMDSv1/VPC endpoints, Azure NSGs, GCP firewall rules/GKE).

```bash
echo "[*] Reviewing network security configuration..."
NET_OUT="$OUTDIR/network_security_${TIMESTAMP}.txt"
# Run provider-specific network commands from REFERENCE.md for $PROVIDER
echo "[+] Network security review written to $NET_OUT"
```

### Step 6: Generate findings report

```bash
echo "[*] Generating consolidated findings report..."
REPORT="$OUTDIR/cloud_pentest_report_${PROVIDER}_${TIMESTAMP}.txt"

cat > "$REPORT" <<HEADER
=======================================================
  CLOUD SECURITY ASSESSMENT REPORT
  Provider  : $(echo "$PROVIDER" | tr '[:lower:]' '[:upper:]')
  Date      : $(date -u '+%Y-%m-%d %H:%M:%S UTC')
  Scope     : ${SECSKILL_SCOPE:-full assessment}
=======================================================

HEADER

echo "--- 1. IAM FINDINGS ---" >> "$REPORT"
cat "$IAM_OUT" >> "$REPORT" 2>/dev/null

echo "" >> "$REPORT"
echo "--- 2. DATA EXPOSURE FINDINGS ---" >> "$REPORT"
cat "$STORAGE_OUT" >> "$REPORT" 2>/dev/null

echo "" >> "$REPORT"
echo "--- 3. NETWORK SECURITY FINDINGS ---" >> "$REPORT"
cat "$NET_OUT" >> "$REPORT" 2>/dev/null

echo "" >> "$REPORT"
echo "--- 4. AUTOMATED SCAN SUMMARY ---" >> "$REPORT"
echo "ScoutSuite output : $SCOUT_OUT" >> "$REPORT"
echo "Prowler output    : $PROWLER_OUT" >> "$REPORT"

# Privilege escalation paths are documented in REFERENCE.md
echo "" >> "$REPORT"
echo "--- 5. PRIVILEGE ESCALATION PATHS TO REVIEW ---" >> "$REPORT"
echo "See REFERENCE.md for the full privilege escalation paths lookup table (AWS/Azure/GCP)." >> "$REPORT"

echo "[+] Report written to $REPORT"
echo ""
echo "===== Cloud Pentest Assessment Summary ====="
echo "Provider      : $PROVIDER"
echo "IAM analysis  : $IAM_OUT"
echo "Storage check : $STORAGE_OUT"
echo "Network check : $NET_OUT"
echo "Full report   : $REPORT"
echo "============================================="
```

## Done when

- Automated ScoutSuite and Prowler scans complete without authentication errors
- IAM analysis output contains policy and role findings
- Storage exposure check covers all buckets/blobs in scope
- Network security review covers security groups/NSGs/firewall rules
- Consolidated report file is present in `$SECSKILL_OUTPUT_DIR`

## Failure modes

| Symptom | Cause | Resolution |
|---------|-------|------------|
| `credentials invalid` | Wrong profile or expired token | Re-authenticate: `aws sso login`, `az login`, `gcloud auth login` |
| ScoutSuite auth error | Insufficient permissions for audit | Ensure ReadOnly or SecurityAudit policy attached |
| `AccessDenied` on S3 API calls | Missing `s3:GetBucketPolicy` permission | Add explicit read permissions to audit role |
| Prowler rate-limited | Too many API calls too fast | Add `--throttling-retry-attempts 3` flag |
| `gsutil: not found` | GCP SDK not installed | Install via `gcloud components install gsutil` |

## Notes

- Only run against **authorized environments**. Cloud API calls leave audit trails in CloudTrail/Activity Log/Cloud Audit Logs.
- For AWS, attaching the managed `SecurityAudit` policy to the assessment role covers most read operations.
- Use `pacu` for hands-on AWS exploitation simulation in lab/authorized environments: `pip install pacu && pacu`.
- CloudMapper (`pip install cloudmapper`) provides visual AWS network topology: `python cloudmapper.py prepare --account $ACCOUNT_ID`.
- All IaC remediation examples (Terraform/CloudFormation) should be scoped to least-privilege and reviewed before applying.
- CIS Benchmark violations from Prowler are classified by level (L1 = mandatory, L2 = defense-in-depth).