<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-cloud-threat-modeling
description: >-
  Threat model cloud-native architectures across AWS, Azure, and GCP.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - cloud-security
  - aws
  - azure
  - gcp
  - iam
  - shared-responsibility
  - serverless
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - "T1078.004"
  - "T1537"
  - "T1580"
  - "T1552.005"
---

# Performing Cloud Threat Modeling

## Overview

Cloud architectures introduce unique threat vectors including IAM misconfigurations, storage
exposure, cross-account trust, serverless function abuse, and shared responsibility gaps. This
technique applies structured threat modeling to AWS, Azure, and GCP environments by analyzing
identity policies, network segmentation, data storage controls, and service configurations.

Mode: `[MODE: ARCHITECT]` — Cloud-native security architecture and threat analysis.

## Prerequisites

- Cloud architecture diagrams and IaC templates (Terraform, CloudFormation)
- AWS CLI / Azure CLI / gcloud CLI for configuration review
- `prowler` for AWS: `pip install prowler`
- `ScoutSuite` for multi-cloud: `pip install scoutsuite`
- Python 3.10+

## Key Concepts

### Shared Responsibility Model

| Layer | Provider Manages | Customer Manages |
|-------|-----------------|-----------------|
| Physical | Data centers, hardware | — |
| Network | Global backbone, DDoS | VPC config, NACLs, SGs |
| Compute | Hypervisor, host OS | Guest OS, patching, apps |
| Identity | IAM service availability | IAM policies, MFA, roles |
| Data | Storage durability | Encryption, access control, classification |

### Cloud Threat Categories

| Category | Threats | Key Controls |
|----------|---------|-------------|
| **Identity** | Over-privileged roles, credential leakage | Least privilege, MFA, key rotation |
| **Network** | Public exposure, missing segmentation | VPC, private endpoints, WAF |
| **Storage** | Public buckets, unencrypted data | Bucket policies, CMK encryption |
| **Compute** | SSRF, container escape, function abuse | IMDSv2, network policies, limits |
| **Logging** | Disabled audit logs, log tampering | Centralized logging, immutable storage |

## Workflow

### Step 1: Enumerate Cloud Assets

```bash
node scripts/agent.js --action enumerate --input cloud_config.json
node scripts/agent.js --action analyze --input cloud_config.json
```

### Step 2: Identify Cloud Threats

```bash
node scripts/agent.js --action threats --input assets.json
```

### Step 3: Generate Report

```bash
node scripts/agent.js --action report --input threats.json --output report.json
```

## Verification

- [ ] All cloud services inventoried with region, public exposure, and encryption status
- [ ] IAM policies reviewed for least privilege adherence
- [ ] Network segmentation validated — no unnecessary public exposure
- [ ] Storage permissions audited — no public buckets or unencrypted sensitive data
- [ ] Logging enabled and centralized across all accounts and regions
- [ ] Shared responsibility gaps identified and documented

## References

- [AWS Well-Architected — Security Pillar](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/)
- [Azure Threat Modeling](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)
- [GCP Security Best Practices](https://cloud.google.com/security/best-practices)
- [MITRE ATT&CK Cloud Matrix](https://attack.mitre.org/matrices/enterprise/cloud/)
- [CSA Cloud Controls Matrix](https://cloudsecurityalliance.org/research/cloud-controls-matrix/)
