cloud-audit

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Cloud Audit — Cloud Infrastructure Security Review

云审计 — 云基础设施安全审查

Audit cloud infrastructure configurations for misconfigurations, excessive permissions, public exposure, and compliance gaps. Covers AWS, GCP, and Azure.

Cross-references:

iam-audit

for the consultant-style IAM deep-dive (design / audit / migrate across identity providers and federation patterns) — this skill includes an IAM section but stays at the cloud-posture level; for role design, JIT access, workload identity federation, and migration plans, invoke

iam-audit

container-audit

for Kubernetes-specific posture sitting on top of cloud.

secrets-audit

for secrets-manager hygiene and rotation.

Findings should use the three-disposition rule (Fixed / Deferred / Accepted Risk) per

owasp-audit

's Report Format.

针对云基础设施配置进行配置错误、过度权限、公共暴露及合规漏洞审计，覆盖AWS、GCP和Azure。

交叉参考：

iam-audit

用于顾问式IAM深度调研（跨身份提供商和联邦模式的设计/审计/迁移）——本技能包含IAM相关内容，但仅停留在云态势层面；若涉及角色设计、即时访问（JIT）、工作负载身份联邦及迁移计划，请调用

iam-audit

。

container-audit

用于基于云环境的Kubernetes专属态势审计。

secrets-audit

用于密钥管理器的卫生检查与轮换审计。

审计结果需遵循

owasp-audit

报告格式中的三类处置规则（已修复/延期处理/风险接受）。

Scope the Audit

审计范围界定

Identify:

Cloud provider(s) and account(s)
Regions in use
Whether CLI tools are available (
```
aws
```
,
```
gcloud
```
,
```
az
```
) or reviewing IaC files (Terraform, CloudFormation, Pulumi)

明确以下信息：

云服务商及账号
正在使用的区域
是否可使用CLI工具（
```
aws
```
、
```
gcloud
```
、
```
az
```
），或需审查IaC文件（Terraform、CloudFormation、Pulumi）

Audit Categories

审计类别

Identity and Access Management

身份与访问管理（IAM）

AWS:

bash

aws iam get-account-summary
aws iam list-users
aws iam generate-credential-report && aws iam get-credential-report --output text --query Content | base64 -d

Check for: root account usage without MFA, access keys older than 90 days, unused credentials, wildcard permissions (

"Action": "*"

), overprivileged roles.

GCP:

bash

gcloud projects get-iam-policy $PROJECT_ID
gcloud iam service-accounts list

Check for: primitive roles (Owner/Editor) on too many principals, unused service accounts, service account keys instead of workload identity.

Azure:

bash

az role assignment list --all
az ad user list

Check for: excessive Owner/Contributor assignments, guest users with high privileges.

IaC review: Grep Terraform/CloudFormation files for

"Action": "*"

"Resource": "*"

, hardcoded secrets, overly broad trust policies.

AWS：

bash

aws iam get-account-summary
aws iam list-users
aws iam generate-credential-report && aws iam get-credential-report --output text --query Content | base64 -d

检查要点：未启用MFA的根账号使用情况、超过90天的访问密钥、未使用的凭证、通配符权限（

"Action": "*"

）、权限过度的角色。

GCP：

bash

gcloud projects get-iam-policy $PROJECT_ID
gcloud iam service-accounts list

检查要点：过多主体拥有基础角色（Owner/Editor）、未使用的服务账号、使用服务账号密钥而非工作负载身份。

Azure：

bash

az role assignment list --all
az ad user list

检查要点：过度分配Owner/Contributor权限、拥有高权限的外部用户。

IaC审查： 在Terraform/CloudFormation文件中搜索

"Action": "*"

、

"Resource": "*"

、硬编码密钥、过于宽泛的信任策略。

Network Security

网络安全

Check for:

Security groups or firewall rules allowing
```
0.0.0.0/0
```
ingress
Unrestricted SSH (port 22) or RDP (port 3389) from the internet
VPC flow logs disabled
Databases in public subnets
Missing network segmentation between tiers

检查要点：

安全组或防火墙规则允许
```
0.0.0.0/0
```
入站访问
互联网可无限制访问SSH（22端口）或RDP（3389端口）
VPC流量日志未启用
数据库位于公共子网
各层级间缺少网络分段

Storage

存储服务

AWS S3:

bash

aws s3api list-buckets
aws s3api get-public-access-block --bucket <name>
aws s3api get-bucket-policy --bucket <name>
aws s3api get-bucket-encryption --bucket <name>

Check for: public buckets, missing encryption, no versioning, no lifecycle policies, overly permissive bucket policies.

GCP/Azure: Equivalent checks for Cloud Storage and Blob Storage — look for

allUsers

allAuthenticatedUsers

access or anonymous blob access.

AWS S3：

bash

aws s3api list-buckets
aws s3api get-public-access-block --bucket <name>
aws s3api get-bucket-policy --bucket <name>
aws s3api get-bucket-encryption --bucket <name>

检查要点：公共存储桶、未启用加密、未开启版本控制、无生命周期策略、权限过度宽松的存储桶策略。

GCP/Azure： 针对Cloud Storage和Blob Storage执行等效检查——排查

allUsers

allAuthenticatedUsers

访问权限或匿名Blob访问情况。

Compute

计算资源

IMDSv2 enforced? (AWS:
```
HttpTokens = required
```
)
Unencrypted EBS volumes or disks
Public IP addresses on instances that don't need them
Outdated AMIs or images (check patch age)
Privileged containers, missing security contexts in Kubernetes

是否强制启用IMDSv2？（AWS：
```
HttpTokens = required
```
）
未加密的EBS卷或磁盘
不需要公网IP的实例配置了公网IP
过时的AMI或镜像（检查补丁更新时长）
权限过高的容器、Kubernetes中缺失安全上下文

Logging and Monitoring

日志与监控

CloudTrail / Cloud Audit Logs / Activity Log enabled in all regions
Log storage: encrypted, immutable, adequate retention
GuardDuty / Security Command Center / Defender for Cloud enabled
Alerting configured for: root login, IAM changes, security group changes, large data transfers
VPC Flow Logs and DNS query logs enabled

CloudTrail / Cloud Audit Logs / Activity Log是否在所有区域启用
日志存储：是否加密、不可篡改、保留时长充足
GuardDuty / Security Command Center / Defender for Cloud是否启用
是否配置告警：根账号登录、IAM变更、安全组变更、大规模数据传输
VPC流量日志和DNS查询日志是否启用

Secrets Management

密钥管理

Hardcoded secrets in source code, environment variables, or IaC files
Secrets Manager / Key Vault usage for sensitive values
KMS key rotation configured

源代码、环境变量或IaC文件中存在硬编码密钥
是否使用Secrets Manager / Key Vault存储敏感值
是否配置KMS密钥轮换

Output Format

输出格式

markdown

undefined

markdown

undefined

Cloud Security Audit Report

云安全审计报告

Account(s): [account ID(s)]

账号：[账号ID]

Provider: [AWS/GCP/Azure]

服务商：[AWS/GCP/Azure]

Regions: [audited regions]

区域：[审计区域]

Date: [date]

日期：[日期]

Summary

摘要

Total findings: X
Critical: X | High: X | Medium: X | Low: X

总发现数：X
严重：X | 高：X | 中：X | 低：X

Findings

发现详情

[SEVERITY] [Category]: [Title]

[严重级别] [类别]：[标题]

Resource: [resource ARN/ID] Region: [region]

Issue: [What the misconfiguration is]

Risk: [What an attacker could do]

Evidence: [CLI output or IaC snippet]

Remediation: [Specific fix command or IaC change]

资源： [资源ARN/ID] 区域： [区域]

问题： [配置错误内容]

风险： [攻击者可实施的操作]

证据： [CLI输出或IaC代码片段]

修复方案： [具体修复命令或IaC修改方式]

Prioritized Action Plan

优先级行动计划

[Critical — immediate]
[High — this week]
[Medium — this month]
[Low — next quarter]

undefined

[严重 — 立即处理]
[高 — 本周内处理]
[中 — 本月内处理]
[低 — 下季度处理]

undefined

Boundaries

边界限制

Only audit accounts or projects the user has access to
Do not attempt to access other accounts or tenants
Provide remediation for every finding
Note if a fix might impact availability (e.g., tightening a security group could break connectivity)
Flag any evidence of active compromise found during the audit
Refuse requests to exploit found misconfigurations on others' infrastructure

仅审计用户有权访问的账号或项目
不得尝试访问其他账号或租户
为每个发现提供修复方案
若修复可能影响可用性（例如：收紧安全组可能中断连接），需加以说明
若审计过程中发现主动入侵迹象，需标记出来
拒绝利用发现的配置错误攻击他人基础设施的请求

References

参考资料

CIS Benchmarks for AWS/GCP/Azure
AWS Well-Architected Security Pillar
ScoutSuite (multi-cloud auditing tool)

AWS/GCP/Azure的CIS基准
AWS架构完善框架安全支柱
ScoutSuite（多云审计工具）