Cloud Security Assessment #40
Description
Description
AWS, Azure, GCP scanning. S3 buckets, IAM misconfigs, K8s security, all mapped into Neo4j.
What already exists
- Kubernetes API exposure detection (ports 6443, 8443, 443)
- Nuclei cloud tags (aws, azure, gcp, docker, kubernetes)
- AWS metadata SSRF detection in attack paths
- AWS secret detection in GitHub Secret Hunter
- GVM scanner handles cloud targets (CONSIDER_ALIVE for ICMP-blocked hosts)
What needs to be built
- S3/Blob/GCS bucket enumeration and permission testing
- IAM/RBAC auditing (AWS IAM, Azure RBAC, GCP IAM)
- Deep Kubernetes scanning (RBAC, pods, secrets, network policies)
- Cloud API enumeration (AWS, Azure, GCP service discovery)
- Infrastructure-as-Code scanning (Terraform, CloudFormation)
- Cloud-specific Neo4j node types and relationships
- CIS Benchmark checks for cloud providers