---
title: Cloud Security Assessment
url: "https://cs.abinantony.io/services/cloud-security-assessment"
updated: 2026-08-08
type: service
source: Abin Antony Security
---

# Cloud security assessment for AWS, GCP and Azure

> A cloud security assessment reviews IAM permissions, network exposure, storage access, secrets management and CI/CD pipeline trust boundaries across AWS, GCP or Azure. Findings are ranked by blast radius — what an attacker reaches after compromising one identity — rather than by a generic benchmark score.

## Key points

- IAM is reviewed as an attack graph: which identity can escalate to which, and how far a leaked key travels.
- CI/CD is treated as production, because a pipeline with deploy credentials is the shortest path into your accounts.
- Benchmark tooling provides coverage; the ranking and the remediation plan are human work.
- Output is a backlog ordered by exploitability, sized for a team that also has features to ship.

Most cloud incidents are not zero-days. They are a leaked long-lived access key, a build role that can assume anything, a storage bucket exposed by a policy nobody re-read, or a metadata endpoint reachable from a vulnerable web application. The assessment follows those paths in your account.

## What the engagement covers

### Identity and access review

Over-permissive roles and policies, wildcard actions, privilege-escalation paths, unused long-lived credentials, cross-account trust relationships and root or global-admin usage.

### Data exposure

Public and semi-public storage, encryption at rest and in transit, database exposure, backup and snapshot permissions, and log destinations quietly holding PII.

### Network boundaries

Security groups and firewall rules, exposed management ports, load balancer and API gateway configuration, VPC peering, and internal services reachable from the internet.

### Secrets management

Secrets in environment variables, build logs, container images and repositories; rotation practice; and whether the secret manager is actually the source of truth.

### CI/CD and supply chain

Pipeline permissions, third-party action and plugin trust, artefact signing, branch protection, and who can deploy to production without review.

### Detection readiness

Audit logging coverage, retention, alerting on the events that actually matter, and a tabletop walk through one realistic compromise scenario.

## Method

01. **Read-only access** — A scoped read-only role is provisioned by you; no write permissions are requested at any point.
02. **Automated benchmark pass** — ScoutSuite, Prowler and Trivy establish baseline coverage against CIS benchmarks.
03. **Attack-path analysis** — Findings are turned into graphs: from a leaked key or a compromised container, what is reachable and what is escalatable.
04. **Prioritisation workshop** — A session with your team to sort the backlog by exploitability, effort and operational risk of the fix.
05. **Report and hardening plan** — A phased plan — quick wins, structural changes, and the policy work that stops regression.
06. **Free re-scan** — A verification pass after remediation, within 30 days.

## Deliverables

- Prioritised findings with the exact console or IaC change required
- IAM privilege-escalation path diagrams
- CIS benchmark coverage summary per account
- Phased hardening roadmap with effort estimates
- Terraform or policy snippets for the structural fixes
- Free verification pass after remediation

## Facts

| Field | Value |
| --- | --- |
| Duration | 1–2 weeks |
| Indicative price | from ₹70,000 |
| Standards | CIS Benchmarks, AWS Well-Architected Security Pillar, NIST SP 800-53, MITRE ATT&CK Cloud Matrix |
| Tooling | ScoutSuite, Prowler, Trivy, cloudsplaining, Pacu, Terraform, Steampipe |
| Retest | Included free within 30 days |

## Questions

**What access do you need?**

A read-only role such as AWS SecurityAudit, GCP Security Reviewer or Azure Reader, scoped to the accounts in question, created and revoked by you.

**Do you change anything in our account?**

Nothing. The assessment is read-only by design. Every recommended change is documented for your team to apply and review.

**Will this get us through SOC 2 or ISO 27001?**

It closes the technical gaps auditors probe and produces the evidence trail they ask for. The certification itself needs an accredited auditor and a policy programme — this is the engineering half.

**We are on Kubernetes. Is that covered?**

Yes: RBAC, service accounts and token exposure, network policies, pod security context, image provenance and secrets handling are all in scope when a cluster is in the environment.


## Sources

- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [NIST SP 800-53 Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

---

Abin Antony Security — Abin Antony, Kochi, Kerala. Contact: abina35@gmail.com · https://cs.abinantony.io