cloud-security-posture

What this skill does

# Cloud Security Posture Assessment

Cross-cloud security posture assessment for evaluating IAM policies,
encryption configuration, and public exposure across [AWS], [Azure],
and [GCP] environments. This skill provides a unified assessment
methodology — diagnostic reasoning is provider-independent, while
specific commands and console paths use inline provider labels.

This is an assessment skill, not a deep-dive into any single provider's
networking layer. For detailed VPC, VNet, or VPC Network analysis, use
the dedicated provider skills: `aws-networking-audit` for VPC/Security
Group/Transit Gateway, `azure-networking-audit` for VNet/NSG/Route Table,
and `gcp-networking-audit` for VPC Network/Firewall Rule/Cloud Router
analysis. Reference `references/cli-reference.md` for multi-provider
CLI commands organized by audit step, and `references/security-controls.md`
for the IAM hierarchy model, encryption matrix, and CIS benchmark
control ID mapping.

## When to Use

- Multi-cloud security review — assessing posture across two or more cloud providers in a single engagement
- Pre-compliance audit — evaluating IAM, encryption, and exposure gaps before formal CIS or SOC 2 assessment
- Cloud migration security gate — verifying security controls are in place before production traffic cutover
- Incident response scoping — quickly determining cross-cloud exposure surface during a security event
- Periodic posture check — scheduled assessment of IAM hygiene, encryption coverage, and public attack surface
- Merger or acquisition due diligence — evaluating cloud security maturity across inherited environments

## Prerequisites

- **[AWS]** AWS CLI v2 configured (`aws sts get-caller-identity` succeeds); IAM permissions for `iam:List*`, `iam:Get*`, `kms:List*`, `kms:DescribeKey`, `s3:GetBucketEncryption`, `s3:GetBucketPolicyStatus`, `ec2:DescribeSecurityGroups`, `ec2:DescribeInstances`, `elasticloadbalancing:DescribeLoadBalancers`, `rds:DescribeDBInstances`, `acm:ListCertificates`
- **[Azure]** Azure CLI (`az account show` succeeds); RBAC Reader role on target subscriptions; permissions for `Microsoft.Authorization/roleAssignments/read`, `Microsoft.KeyVault/vaults/read`, `Microsoft.Compute/disks/read`, `Microsoft.Network/publicIPAddresses/read`, `Microsoft.Network/networkSecurityGroups/read`, `Microsoft.Storage/storageAccounts/read`
- **[GCP]** gcloud CLI configured (`gcloud auth list` shows active account); roles `roles/iam.securityReviewer`, `roles/cloudkms.viewer`, `roles/compute.viewer`, `roles/storage.admin` (for bucket IAM inspection) on target project(s)
- **Target scope identified** — cloud accounts/subscriptions/projects, regions, and environment tier (prod, staging, dev) defined before assessment begins
- **Assessment window** — coordinate with operations to avoid snapshot timing during deployments or maintenance windows

## Procedure

Follow these six steps sequentially. Each step produces findings that
feed the cross-cloud posture summary in Step 6.

### Step 1: IAM Posture Assessment

Evaluate identity and access management configuration for privilege
escalation risks, excessive permissions, and policy hygiene across
all in-scope providers. Focus on three areas: overly permissive
policies, missing authentication controls, and privilege escalation
paths through role chaining or impersonation.

**[AWS]** Enumerate IAM users, roles, and policies. Check for wildcard
actions in customer-managed policies:

```
aws iam get-account-authorization-details --output json
aws iam list-policies --scope Local --query 'Policies[?AttachmentCount>`0`]'
```

Flag policies with `"Action": "*"` or `"Resource": "*"` as Critical.
Review Service Control Policies (SCPs) in Organizations for boundary
gaps that allow privilege escalation paths (e.g., `iam:CreateRole` +
`iam:AttachRolePolicy` without SCP deny). Check for IAM users with
console access but no MFA: `aws iam get-credential-report`.

**[Azure]** Audit RBAC role assignments and Entra ID configuration:

```
az role assignment list --all --output table
az ad user list --query "[?userType=='Member']" --output table
```

Identify Owner/Contributor role sprawl — assignments at subscription
scope with no expiration indicate missing Privileged Identity Management
(PIM) activation policies. Review Conditional Access policies for gaps:
no policy covering all users, missing device compliance requirements,
or legacy authentication protocols not blocked.

**[GCP]** Analyze IAM bindings and Organization Policy constraints:

```
gcloud projects get-iam-policy <project-id> --format=json
gcloud resource-manager org-policies list --project=<project-id>
```

Flag bindings with `roles/owner` or `roles/editor` on service accounts
as Critical. Check for service account key age exceeding 90 days:
`gcloud iam service-accounts keys list --iam-account=<sa-email>`.
Verify Organization Policy constraints enforce `iam.disableServiceAccountKeyCreation`
where applicable.

### Step 2: Encryption Audit

Assess encryption at rest and in transit across storage, compute,
and database services. Evaluate key management practices including
rotation schedules, access policies, and customer-managed vs
provider-managed key usage.

**[AWS]** Verify KMS key policies, storage encryption, and certificate
management:

```
aws kms list-keys --output table
aws s3api get-bucket-encryption --bucket <bucket-name>
aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier,StorageEncrypted,KmsKeyId]'
```

Check EBS volume encryption: `aws ec2 describe-volumes --query 'Volumes[?!Encrypted]'`.
Review ACM certificate expiry: `aws acm list-certificates --query 'CertificateSummaryList[?Status==`ISSUED`]'`.
Flag any unencrypted S3 buckets, EBS volumes, or RDS instances as
High severity. Verify KMS key rotation is enabled for customer-managed
keys: `aws kms get-key-rotation-status --key-id <key-id>`.

**[Azure]** Audit Key Vault configuration, disk encryption, and TLS:

```
az keyvault list --output table
az disk list --query "[?encryption.type!='EncryptionAtRestWithPlatformKey']" --output table
```

Verify Key Vault access policies follow least privilege — no vault
with "Get, List, Set, Delete" for all principals. Check managed disk
encryption type (platform-managed vs customer-managed keys). Review
TLS minimum version on App Services: `az webapp list --query "[].{name:name, minTlsVersion:siteConfig.minTlsVersion}"`.

**[GCP]** Assess Cloud KMS configuration and default encryption:

```
gcloud kms keyrings list --location=<location>
gcloud kms keys list --keyring=<keyring> --location=<location>
```

Determine CMEK vs Google-managed encryption per service. Flag any
Cloud Storage buckets or Compute disks without CMEK if the
organization policy requires it. Check KMS key rotation period:
`gcloud kms keys describe <key> --keyring=<keyring> --location=<location>`.
Verify SSL policy compliance on load balancers:
`gcloud compute ssl-policies list`.

### Step 3: Public Exposure Detection

Identify publicly accessible resources and evaluate network-level
exposure across all three providers. Public exposure combined with
weak authentication (Step 1) or missing encryption (Step 2) compounds
severity — cross-reference findings when classifying risk.

**[AWS]** Check for public S3 buckets, permissive Security Groups,
and load balancer configuration:

```
aws s3api list-buckets --query 'Buckets[*].Name' --output text
aws s3api get-bucket-policy-status --bucket <bucket-name>
aws ec2 describe-security-groups --filters "Name=ip-permission.cidr,Values=0.0.0.0/0"
```

Flag Security Groups allowing `0.0.0.0/0` ingress on non-standard
ports as Critical. Check ELB access logging: `aws elbv2 describe-load-balancer-attributes --load-balancer-arn <arn> --query 'Attributes[?Key==`access_logs.s3.enabled`]'`.

**[Azure]** Identify public IPs without network security controls:

```
az network public-ip list --output table
az network nsg list --output table
az storage account list --query