Cloud configuration reviews
Review AWS, Azure and Google Cloud configurations without deploying a network agent.
Read-only cloud access
Active owners, administrators and security managers can configure and assess cloud accounts. Each organization uses its own dedicated read-only cloud identity; never supply root or administrator credentials. These checks do not create or change cloud resources. Agents provide separate host and internal-network observations.
AWS
Configure AWS with a 12-digit account ID, a dedicated IAM user access key ID and secret access key, and one to five comma-separated regions. Allow sts:GetCallerIdentity, ec2:DescribeSecurityGroups, cloudtrail:DescribeTrails and cloudtrail:GetTrailStatus. Cross-account role authentication is not supported in this version. Review selected-region security group ingress and existing CloudTrail logging; S3 and IAM entitlements are outside current coverage.
Azure
Create an application in your tenant, assign Reader at the selected subscription and enter the subscription ID, tenant ID, application client ID and client secret. Checks cover storage secure transfer, TLS and public-access configuration, plus configured NSG ingress rules.
Google Cloud
Use a dedicated service account with project read access, Compute Viewer, Storage Viewer and Cloud SQL Viewer permissions. Enable the relevant APIs and supply the JSON credential. Checks cover bucket access controls, configured firewall ingress and Cloud SQL authorized networks. Rotate or revoke the credential through your cloud controls.
Run and review
Save the connection, select Test, then register and authorize a Cloud account asset with an exactly matching aws:ACCOUNT_ID, azure:SUBSCRIPTION_ID or gcp:PROJECT_ID. Run Cloud configuration review. Open Assessments to inspect Cloud coverage and select the finding count for results. Cloud findings are included in the cloud scope of the penetration test report.
Coverage is not certification
Denied permissions, disabled APIs and collection limits are reported as unassessed, not passing. These are baseline configuration reviews, not exploitation or full cloud penetration tests. Configured ingress does not prove effective reachability; validate routing, rule priority and inherited controls. Unobserved cloud findings are not automatically resolved.