<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cloud-vulnerability-scanning
description: >-
  Scan AWS, Azure, and GCP cloud environments for misconfigurations, exposed
  services, and vulnerable workloads using Prowler, ScoutSuite, nuclei, and
  cloud-native security tools. Covers IAM, storage, compute, and network risks.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - cloud-security
  - aws
  - azure
  - gcp
  - prowler
  - scoutsuite
  - misconfigurations
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Performing Cloud Vulnerability Scanning

## Overview

Cloud environments introduce unique vulnerability classes: misconfigured IAM policies,
public storage buckets, exposed management APIs, over-permissioned service accounts,
and unpatched container images. Scanning requires cloud-specific tools that understand
provider APIs and shared responsibility boundaries.

## Prerequisites

| Requirement | Install |
|---|---|
| Prowler | `pip install prowler` |
| ScoutSuite | `pip install scoutsuite` |
| nuclei | `go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest` |
| trivy | `apt install trivy` or `brew install trivy` |
| AWS CLI | `pip install awscli` |
| Python 3.10+ | Agent tooling |

## Key Concepts

### Prowler — AWS/Azure/GCP Compliance

```bash
# Full AWS CIS scan
prowler aws --compliance cis_2.0_aws -M json -o prowler_aws_cis.json

# AWS scan — specific service checks
prowler aws --service s3 iam ec2 -M json -o prowler_services.json

# Azure CIS scan
prowler azure --compliance cis_2.1_azure -M json -o prowler_azure.json

# GCP CIS scan
prowler gcp --compliance cis_2.0_gcp -M json -o prowler_gcp.json

# Prowler — severity filter
prowler aws --severity critical high -M json -o prowler_critical.json

# Prowler dashboard output
prowler aws --compliance cis_2.0_aws -M html -o prowler_report.html
```

### ScoutSuite — Multi-Cloud Assessment

```bash
# AWS assessment
scout aws --report-dir scoutsuite_aws/

# Azure assessment
scout azure --cli --report-dir scoutsuite_azure/

# GCP assessment
scout gcp --user-account --report-dir scoutsuite_gcp/
```

### Container Image Scanning

```bash
# Scan container image with trivy
trivy image --severity CRITICAL,HIGH --format json \
  -o trivy_results.json nginx:latest

# Scan ECR images
trivy image --severity CRITICAL,HIGH \
  $AWS_ACCOUNT.dkr.ecr.$REGION.amazonaws.com/app:latest

# Scan running containers
trivy image --severity CRITICAL,HIGH $(docker ps --format '{{.Image}}' | head -5)

# nuclei cloud templates
nuclei -u https://target.example.com -tags cloud,aws,azure,gcp \
  -severity critical,high -json -o cloud_findings.json
```

### AWS-Specific Checks

```bash
# Check for public S3 buckets
aws s3api list-buckets --query 'Buckets[].Name' --output text | \
  xargs -I{} aws s3api get-bucket-acl --bucket {} --query \
  'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]' 2>/dev/null

# Check for overly permissive security groups
aws ec2 describe-security-groups \
  --filters "Name=ip-permission.cidr,Values=0.0.0.0/0" \
  --query 'SecurityGroups[].{ID:GroupId,Name:GroupName,Ports:IpPermissions[].FromPort}' \
  --output json

# Check IAM users without MFA
aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | \
  base64 -d | awk -F',' '$4 == "false" && $1 != "<root_account>" {print $1}'

# Check for unencrypted EBS volumes
aws ec2 describe-volumes \
  --filters "Name=encrypted,Values=false" \
  --query 'Volumes[].{ID:VolumeId,Size:Size,State:State}' --output json
```

## Workflow

1. **Enumerate** — Discover all cloud accounts, subscriptions, and projects
2. **Compliance scan** — Run Prowler/ScoutSuite against cloud provider APIs
3. **Workload scan** — trivy for container images, nuclei for exposed services
4. **IAM audit** — Review permissions, roles, and access patterns
5. **Network audit** — Check security groups, NACLs, and firewall rules
6. **Report** — Prioritized findings mapped to CIS Cloud Benchmarks

## Detection

```yaml
title: Cloud Vulnerability Scanning Detection
id: 74b66813-1302-4e14-a875-2837dc1c769c
status: experimental
description: Detects suspicious activity related to performing cloud vulnerability scanning techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*cloud*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

| Check | Method |
|---|---|
| Credentials configured | `aws sts get-caller-identity` succeeds |
| Prowler completed | JSON output contains findings array |
| Container images scanned | trivy output includes vulnerability counts |
| Public exposure checked | S3/storage bucket ACL audit complete |
| IAM audit done | MFA, key rotation, permission boundaries reviewed |

## References

- [Prowler Documentation](https://docs.prowler.com/)
- [CIS AWS Foundations Benchmark](https://www.cisecurity.org/benchmark/amazon_web_services)
- [Trivy Documentation](https://aquasecurity.github.io/trivy/)
- [ScoutSuite](https://github.com/nccgroup/ScoutSuite)
