Cloud Configuration & Architecture
Hardening and IAM audits across AWS, Microsoft Azure, and Google Cloud Platform environments.
Last reviewed by Rhitik Kumar, Lead Offensive Security Engineer.
Scope of Assessment
We review your cloud architecture and configuration state: publicly exposed storage buckets, IAM policies audited for least-privilege enforcement, and network security groups inspected across every account in scope.
Engagement Details
How the engagement runs
- 01
Scoping and read-only access
We agree which accounts, subscriptions or projects are in scope and take a read-only audit role. No changes are made to your environment.
- 02
Configuration review
Storage exposure, encryption at rest and in transit, logging and monitoring coverage, network security groups and public endpoints are reviewed against CIS Benchmarks and provider guidance.
- 03
Identity and privilege analysis
IAM roles, policies, service accounts and trust relationships are analysed for least-privilege violations and privilege escalation paths between identities.
- 04
Reporting and retest
Findings are grouped by account and severity, with the exact console or CLI change that fixes each one, plus one retest within 30 days.
What you receive
- Configuration findings mapped to CIS Benchmarks
- IAM privilege escalation paths with the identities involved
- Publicly exposed asset inventory
- Infrastructure-as-code fixes where you use Terraform or CloudFormation
- Retest report after remediation
Frequently Asked Questions
Which cloud providers do you support?
We support Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure environments.
Do you need write access to our cloud account?
No. A read-only audit role is enough for the configuration and identity review. Anything requiring an active test is agreed separately and scheduled with you.
Is Kubernetes included?
Yes. Cluster RBAC, pod security, network policies, secrets handling and exposed dashboards are covered where clusters are in scope.
Can you map findings to SOC 2 or ISO 27001?
Yes. Cloud findings can be mapped to the control you are being audited against, which is often how teams use this engagement ahead of certification.
Related security services
Let's map out your testing strategy.
Have a custom compliance framework or specific targeting parameters? Schedule a scoping session with our senior offensive leads.