Multi-cloud security assessment skill for AWS, Azure, and GCP. This skill should be used when performing cloud security audits, scanning for misconfigurations, testing IAM policies, auditing storage permissions, and identifying privilege escalation paths. Triggers on requests to audit cloud security, scan AWS/Azure/GCP, check cloud misconfigurations, or perform cloud penetration testing.
Thin router for security assessment of AWS, GCP, and Azure environments. The body of knowledge lives in per-cloud references/, per-domain methodology/, and per-scope workflows/. Load only what the current task needs.
audit AWS security, scan Azure for misconfigurations, check GCP security, test cloud IAM, find S3 bucket issues, cloud penetration test, CIS benchmark audit, cloud privilege escalation, multi-cloud assessment.
| If the task is… | Use instead |
|---|---|
| Scanning Terraform / CloudFormation / ARM / Bicep / Pulumi files pre-deploy | iac-security |
| Container image CVEs or scanning running workloads on EKS / GKE / AKS | container-security |
| Testing an application hosted in the cloud (OWASP, BOLA, XSS, SQLi) | api-security or dast-automation |
| Source-code SAST of cloud-deployed apps | sast-orchestration |
| LLM-specific attacks against a cloud-hosted model | llm-security |
This skill assumes you have credentials against a live cloud account. If you only have source artifacts, route to the sibling skills above.
Target scope?
├─ Single cloud (AWS only) → workflows/aws_full_assessment.md
├─ Single cloud (GCP only) → workflows/gcp_full_assessment.md
├─ Single cloud (Azure only) → workflows/azure_full_assessment.md
└─ 2+ clouds / federated → workflows/cross_cloud_comparison.md (fan out per-cloud)
Within a cloud, narrow by domain:
├─ IAM / identity / privesc → methodology/iam_privilege_escalation.md
├─ Storage exposure (S3/GCS/Blob) → methodology/storage_misconfig.md
├─ Networking / firewall / IMDS → methodology/network_security.md
├─ Secrets / KMS / Key Vault → methodology/secrets_management.md
└─ CIS/compliance full sweep → the workflow for that cloud (runs scanners)
Need specific commands or tool invocations?
├─ AWS → references/aws.md
├─ GCP → references/gcp.md
├─ Azure → references/azure.md
├─ Tooling → references/cloud_tools.md
└─ SQL → references/steampipe_queries.sql
Parallelize freely:
Must be sequential:
Spawn sub-agents when:
workflows/<cloud>_full_assessment.md.Coordinator responsibilities: scope enforcement, credential distribution, finding deduplication, cross-cloud correlation.
workflows/cross_cloud_comparison.md Phase F-1.Attach to evidence.screenshot in the finding schema.
All findings conform to schemas/finding.json. Key cloud-specific fields:
cloud_provider, account_id, region, service, resource_arn, cis_benchmark_id, compliance (array of CIS / SOC2 / PCI-DSS / HIPAA / GDPR / NIST-800-53 / ISO-27001), privilege_escalation_path, detection.
| Workflow | Use for |
|---|---|
| workflows/aws_full_assessment.md | End-to-end AWS account or org audit |
| workflows/gcp_full_assessment.md | End-to-end GCP project / folder / org audit |
| workflows/azure_full_assessment.md | End-to-end Azure subscription + Entra ID audit |
| workflows/cross_cloud_comparison.md | 2+ clouds, federated identity, unified rollup |
| Methodology | Scope |
|---|---|
| methodology/iam_privilege_escalation.md | Known privesc vectors across AWS / GCP / Azure; extended-thinking heavy |
| methodology/storage_misconfig.md | S3 / GCS / Azure Blob exposure and encryption checks |
| methodology/network_security.md | Firewall / NSG / SG audit, IMDS posture, SSRF chains |
| methodology/secrets_management.md | Secret stores, rotation, env-var exfil surfaces |
| Reference | Content |
|---|---|
| references/aws.md | AWS CLI commands, Prowler invocations, S3/IAM/EC2/RDS checks, misconfig catalog |
| references/gcp.md | gcloud commands, GCS/IAM/Compute checks, org policy quick-list |
| references/azure.md | az CLI commands, ARM + Entra ID enumeration, Key Vault/Storage/NSG checks |
| references/cloud_tools.md | ScoutSuite / Prowler / CloudSploit / Steampipe / Pacu / ROADtools comparison + invocation |
| references/steampipe_queries.sql | Ready-to-run Steampipe SQL covering public storage, permissive IAM, exposed network, encryption gaps — cross-cloud patterns |
| references/bounty_patterns_2024_2026.md | Post-2023 bounty TTPs (ConfusedFunction, Cloud Run bypass, Compute IAM + tag chain, AWSMarketplaceFullAccess → admin, SSRF DNS rebinding, CVE-2025-61882 Oracle EBS, blind-SSRF redirect loop) |
| Tool | Purpose | Install |
|---|---|---|
| ScoutSuite | Multi-cloud audit with HTML dashboard | pip install scoutsuite |
| Prowler | Deep AWS/Azure/GCP CIS + compliance | pip install prowler |
| CloudSploit | Fast triage CSPM | npm install -g cloudsploit |
| Steampipe | Declarative SQL over cloud APIs | brew install turbot/tap/steampipe |
| Pacu | AWS offense / privesc modules | pip install pacu |
| PMapper | AWS IAM privesc graph | pip install principalmapper |
| ROADtools | Entra ID enumeration + offline analysis | pip install roadrecon |
| enumerate-iam | Blind AWS IAM enumeration | pip install enumerate-iam |
| s3scanner | External S3 bucket discovery | pip install s3scanner |
Edit PDFs with natural-language instructions using the nano-pdf CLI.
Control Sonos speakers (discover/status/play/volume/group).
Terminal Spotify playback/search via spogo (preferred) or spotify_player.
Capture frames or clips from RTSP/ONVIF cameras.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI.
Category:tools