Back to Details

cloud-audit

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Cloud Audit — Cloud Infrastructure Security Review

云审计 — 云基础设施安全审查

Audit cloud infrastructure configurations for misconfigurations, excessive permissions, public exposure, and compliance gaps. Covers AWS, GCP, and Azure.
Cross-references: 
iam-audit
for the consultant-style IAM deep-dive (design / audit / migrate across identity providers and federation patterns) — this skill includes an IAM section but stays at the cloud-posture level; for role design, JIT access, workload identity federation, and migration plans, invoke 
iam-audit
. 
container-audit
for Kubernetes-specific posture sitting on top of cloud. 
secrets-audit
for secrets-manager hygiene and rotation.
Findings should use the three-disposition rule (Fixed / Deferred / Accepted Risk) per 
owasp-audit
's Report Format.
针对云基础设施配置进行配置错误、过度权限、公共暴露及合规漏洞审计，覆盖AWS、GCP和Azure。
交叉参考：
iam-audit
用于顾问式IAM深度调研（跨身份提供商和联邦模式的设计/审计/迁移）——本技能包含IAM相关内容，但仅停留在云态势层面；若涉及角色设计、即时访问（JIT）、工作负载身份联邦及迁移计划，请调用
iam-audit
。
container-audit
用于基于云环境的Kubernetes专属态势审计。
secrets-audit
用于密钥管理器的卫生检查与轮换审计。
审计结果需遵循
owasp-audit
报告格式中的三类处置规则（已修复/延期处理/风险接受）。

Scope the Audit

审计范围界定

Identify:
  1. Cloud provider(s) and account(s)
  2. Regions in use
  3. Whether CLI tools are available (
    aws
    , 
    gcloud
    , 
    az
    ) or reviewing IaC files (Terraform, CloudFormation, Pulumi)
明确以下信息：
  1. 云服务商及账号
  2. 正在使用的区域
  3. 是否可使用CLI工具（
    aws
    、
    gcloud
    、
    az
    ），或需审查IaC文件（Terraform、CloudFormation、Pulumi）

Audit Categories

审计类别

Identity and Access Management

身份与访问管理（IAM）

AWS:
bash
aws iam get-account-summary
aws iam list-users
aws iam generate-credential-report && aws iam get-credential-report --output text --query Content | base64 -d
Check for: root account usage without MFA, access keys older than 90 days, unused credentials, wildcard permissions (
"Action": "*"
), overprivileged roles.
GCP:
bash
gcloud projects get-iam-policy $PROJECT_ID
gcloud iam service-accounts list
Check for: primitive roles (Owner/Editor) on too many principals, unused service accounts, service account keys instead of workload identity.
Azure:
bash
az role assignment list --all
az ad user list
Check for: excessive Owner/Contributor assignments, guest users with high privileges.
IaC review: Grep Terraform/CloudFormation files for 
"Action": "*"
, 
"Resource": "*"
, hardcoded secrets, overly broad trust policies.
AWS：
bash
aws iam get-account-summary
aws iam list-users
aws iam generate-credential-report && aws iam get-credential-report --output text --query Content | base64 -d
检查要点：未启用MFA的根账号使用情况、超过90天的访问密钥、未使用的凭证、通配符权限（
"Action": "*"
）、权限过度的角色。
GCP：
bash
gcloud projects get-iam-policy $PROJECT_ID
gcloud iam service-accounts list
检查要点：过多主体拥有基础角色（Owner/Editor）、未使用的服务账号、使用服务账号密钥而非工作负载身份。
Azure：
bash
az role assignment list --all
az ad user list
检查要点：过度分配Owner/Contributor权限、拥有高权限的外部用户。
IaC审查： 在Terraform/CloudFormation文件中搜索
"Action": "*"
、
"Resource": "*"
、硬编码密钥、过于宽泛的信任策略。

Network Security

网络安全

Check for:
  • Security groups or firewall rules allowing 
    0.0.0.0/0
    ingress
  • Unrestricted SSH (port 22) or RDP (port 3389) from the internet
  • VPC flow logs disabled
  • Databases in public subnets
  • Missing network segmentation between tiers
检查要点：
  • 安全组或防火墙规则允许
    0.0.0.0/0
    入站访问
  • 互联网可无限制访问SSH（22端口）或RDP（3389端口）
  • VPC流量日志未启用
  • 数据库位于公共子网
  • 各层级间缺少网络分段

Storage

存储服务

AWS S3:
bash
aws s3api list-buckets
aws s3api get-public-access-block --bucket <name>
aws s3api get-bucket-policy --bucket <name>
aws s3api get-bucket-encryption --bucket <name>
Check for: public buckets, missing encryption, no versioning, no lifecycle policies, overly permissive bucket policies.
GCP/Azure: Equivalent checks for Cloud Storage and Blob Storage — look for 
allUsers
/
allAuthenticatedUsers
access or anonymous blob access.
AWS S3：
bash
aws s3api list-buckets
aws s3api get-public-access-block --bucket <name>
aws s3api get-bucket-policy --bucket <name>
aws s3api get-bucket-encryption --bucket <name>
检查要点：公共存储桶、未启用加密、未开启版本控制、无生命周期策略、权限过度宽松的存储桶策略。
GCP/Azure： 针对Cloud Storage和Blob Storage执行等效检查——排查
allUsers
/
allAuthenticatedUsers
访问权限或匿名Blob访问情况。

Compute

计算资源

  • IMDSv2 enforced? (AWS: 
    HttpTokens = required
    )
  • Unencrypted EBS volumes or disks
  • Public IP addresses on instances that don't need them
  • Outdated AMIs or images (check patch age)
  • Privileged containers, missing security contexts in Kubernetes
  • 是否强制启用IMDSv2？（AWS：
    HttpTokens = required
    ）
  • 未加密的EBS卷或磁盘
  • 不需要公网IP的实例配置了公网IP
  • 过时的AMI或镜像（检查补丁更新时长）
  • 权限过高的容器、Kubernetes中缺失安全上下文

Logging and Monitoring

日志与监控

  • CloudTrail / Cloud Audit Logs / Activity Log enabled in all regions
  • Log storage: encrypted, immutable, adequate retention
  • GuardDuty / Security Command Center / Defender for Cloud enabled
  • Alerting configured for: root login, IAM changes, security group changes, large data transfers
  • VPC Flow Logs and DNS query logs enabled
  • CloudTrail / Cloud Audit Logs / Activity Log是否在所有区域启用
  • 日志存储：是否加密、不可篡改、保留时长充足
  • GuardDuty / Security Command Center / Defender for Cloud是否启用
  • 是否配置告警：根账号登录、IAM变更、安全组变更、大规模数据传输
  • VPC流量日志和DNS查询日志是否启用

Secrets Management

密钥管理

  • Hardcoded secrets in source code, environment variables, or IaC files
  • Secrets Manager / Key Vault usage for sensitive values
  • KMS key rotation configured
  • 源代码、环境变量或IaC文件中存在硬编码密钥
  • 是否使用Secrets Manager / Key Vault存储敏感值
  • 是否配置KMS密钥轮换

Output Format

输出格式

markdown
undefined
markdown
undefined

Cloud Security Audit Report

云安全审计报告

Account(s): [account ID(s)]

账号：[账号ID]

Provider: [AWS/GCP/Azure]

服务商：[AWS/GCP/Azure]

Regions: [audited regions]

区域：[审计区域]

Date: [date]

日期：[日期]

Summary

摘要

  • Total findings: X
  • Critical: X | High: X | Medium: X | Low: X
  • 总发现数：X
  • 严重：X | 高：X | 中：X | 低：X

Findings

发现详情

[SEVERITY] [Category]: [Title]

[严重级别] [类别]：[标题]

Resource: [resource ARN/ID] Region: [region]
Issue: [What the misconfiguration is]
Risk: [What an attacker could do]
Evidence: [CLI output or IaC snippet]
Remediation: [Specific fix command or IaC change]
资源： [资源ARN/ID] 区域： [区域]
问题： [配置错误内容]
风险： [攻击者可实施的操作]
证据： [CLI输出或IaC代码片段]
修复方案： [具体修复命令或IaC修改方式]

Prioritized Action Plan

优先级行动计划

  1. [Critical — immediate]
  2. [High — this week]
  3. [Medium — this month]
  4. [Low — next quarter]
undefined
  1. [严重 — 立即处理]
  2. [高 — 本周内处理]
  3. [中 — 本月内处理]
  4. [低 — 下季度处理]
undefined

Boundaries

边界限制

  • Only audit accounts or projects the user has access to
  • Do not attempt to access other accounts or tenants
  • Provide remediation for every finding
  • Note if a fix might impact availability (e.g., tightening a security group could break connectivity)
  • Flag any evidence of active compromise found during the audit
  • Refuse requests to exploit found misconfigurations on others' infrastructure
  • 仅审计用户有权访问的账号或项目
  • 不得尝试访问其他账号或租户
  • 为每个发现提供修复方案
  • 若修复可能影响可用性（例如：收紧安全组可能中断连接），需加以说明
  • 若审计过程中发现主动入侵迹象，需标记出来
  • 拒绝利用发现的配置错误攻击他人基础设施的请求

References

参考资料

  • CIS Benchmarks for AWS/GCP/Azure
  • AWS Well-Architected Security Pillar
  • ScoutSuite (multi-cloud auditing tool)
  • AWS/GCP/Azure的CIS基准
  • AWS架构完善框架安全支柱
  • ScoutSuite（多云审计工具）