SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillscloud-security-audit

cloud-security-audit

Security & auditing

View repository

Updated 10-16 04:58

About this skill

Cloud Security Audit

Overview

Cloud security auditing is an important part of assessing the security of cloud environments. This skill provides methods, tools, and best practices for cloud security auditing, covering major cloud platforms such as AWS, Azure, and GCP.

Audit Scope

1. Identity and Access Management

Check items:

  • IAM policy configuration
  • User permissions
  • Role permissions
  • Access key management

2. Network Security

Check items:

  • Security group configuration
  • Network ACL
  • VPC configuration
  • Traffic encryption

3. Data Security

Check items:

  • Data encryption
  • Key management
  • Backup strategy
  • Data classification

4. Compliance

Check items:

  • Compliance framework
  • Audit logs
  • Monitoring alerts
  • Incident response

AWS Security Audit

IAM Audit

Check IAM policies:

# 列出所有IAM用户
aws iam list-users

# 列出所有IAM策略
aws iam list-policies

# 检查用户权限
aws iam list-user-policies --user-name username
aws iam list-attached-user-policies --user-name username

# 检查角色权限
aws iam list-role-policies --role-name rolename

Common issues:

  • Excessive permissions
  • Unused access keys
  • Weak password policy
  • MFA not enabled

S3 Security Audit

Check S3 buckets:

# 列出所有存储桶
aws s3 ls

# 检查存储桶策略
aws s3api get-bucket-policy --bucket bucketname

# 检查存储桶ACL
aws s3api get-bucket-acl --bucket bucketname

# 检查存储桶加密
aws s3api get-bucket-encryption --bucket bucketname

Common issues:

  • Public access
  • Not encrypted
  • Versioning not enabled
  • Logging not enabled

Security Group Audit

Check security groups:

# 列出所有安全组
aws ec2 describe-security-groups

# 检查开放端口
aws ec2 describe-security-groups --group-ids sg-xxx

Common issues:

  • 0.0.0.0/0 open
  • Unnecessary ports open
  • Rules too permissive

CloudTrail Audit

Check audit logs:

# 列出所有跟踪
aws cloudtrail describe-trails

# 检查日志文件完整性
aws cloudtrail get-trail-status --name trailname

Azure Security Audit

Subscriptions and Resource Groups

Check subscriptions:

# 列出所有订阅
az account list

# 检查资源组
az group list

Network Security Groups

Check NSGs:

# 列出所有NSG
az network nsg list

# 检查NSG规则
az network nsg rule list --nsg-name nsgname --resource-group rgname

Storage Accounts

Check storage accounts:

# 列出所有存储账户
az storage account list

# 检查访问策略
az storage account show --name accountname --resource-group rgname

GCP Security Audit

Projects and Organizations

Check projects:

# 列出所有项目
gcloud projects list

# 检查IAM策略
gcloud projects get-iam-policy project-id

Compute Engine

Check instances:

# 列出所有实例
gcloud compute instances list

# 检查防火墙规则
gcloud compute firewall-rules list

Storage

Check buckets:

# 列出所有存储桶
gsutil ls

# 检查存储桶权限
gsutil iam get gs://bucketname

Automation Tools

Scout Suite

# AWS审计
scout aws

# Azure审计
scout azure

# GCP审计
scout gcp

Prowler

# AWS安全审计
prowler -c check11,check12,check13

# 完整审计
prowler

CloudSploit

# 扫描AWS账户
cloudsploit scan aws

# 扫描Azure订阅
cloudsploit scan azure

Pacu

# AWS渗透测试框架
pacu

Audit Checklist

IAM Security

  • Check user permissions
  • Check role permissions
  • Check access keys
  • Check password policy
  • Check MFA enablement status

Network Security

  • Check security group/NSG rules
  • Check VPC configuration
  • Check network ACL
  • Check traffic encryption

Data Security

  • Check data encryption
  • Check key management
  • Check backup strategy
  • Check data classification

Compliance

  • Check audit logs
  • Check monitoring alerts
  • Check incident response
  • Check compliance framework

Common Security Issues

1. Excessive Permissions

Issue:

  • IAM policies too permissive
  • Users have administrator permissions
  • Excessive role permissions

Fix:

  • Principle of least privilege
  • Regularly review permissions
  • Use IAM policy simulation

2. Public resources

Problem:

  • S3 bucket public
  • Security group open to 0.0.0.0/0
  • Database publicly accessible

Fix:

  • Restrict access scope
  • Use private network
  • Enable access control

3. Unencrypted data

Problem:

  • Storage not encrypted
  • Transmission not encrypted
  • Improper key management

Fix:

  • Enable encryption
  • Use TLS/SSL
  • Use key management service

4. Missing logs

Problem:

  • Audit logs not enabled
  • Logs not retained
  • Logs not monitored

Fix:

  • Enable CloudTrail/Azure Monitor
  • Set log retention policy
  • Configure monitoring alerts

Best practices

1. Least privilege

  • Grant only necessary permissions
  • Regularly review permissions
  • Use IAM policy simulation

2. Multi-layered protection

  • Network layer protection
  • Application layer protection
  • Data layer protection

3. Monitoring and alerting

  • Enable audit logs
  • Configure monitoring alerts
  • Establish an incident response process

4. Compliance

  • Follow compliance frameworks
  • Regular security audits
  • Document security policies

Precautions

  • Conduct audits only in authorized environments
  • Avoid impacting production environments
  • Note differences between cloud platforms
  • Conduct regular security audits