Published · By the Aesparrow Security Research Team
Short answer
A cloud security checklist verifies identity and access management, storage exposure, network controls, workload and Kubernetes configuration, encryption and key management, and logging and detection across AWS, Azure or GCP. Cloud penetration testing then attempts to exploit misconfigurations to prove which attack paths are real.
Cloud security checklist
- Identity: MFA everywhere, no long-lived keys, least-privilege roles.
- Storage: no public buckets or blobs; encryption at rest.
- Network: restricted security groups, private endpoints, segmented VPCs/VNets.
- Compute & containers: hardened images, IMDSv2, Kubernetes RBAC and admission policies.
- Secrets & keys: managed key services, rotation and vaulted secrets.
- Logging: audit logs on in every account, centralised and alerted.
- Governance: organisation policies and guardrails across accounts.
Cloud penetration testing methodology
- 1Scope and authoriseConfirm accounts, services and provider testing rules.
- 2Configuration reviewAssess against CIS Benchmarks for AWS, Azure or GCP.
- 3External attack surface testingTest internet-exposed services and applications.
- 4Assumed-breach testingStart from a low-privilege identity and attempt privilege escalation.
- 5Report and remediatePrioritised findings with infrastructure-as-code fixes.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
Do I need permission from AWS, Azure or Google to pentest?
Each provider publishes rules for customer testing; for most services no prior approval is needed as long as you stay within their policy.