Toolkit · Cloud · about 5 minutes
Cloud Security Posture Check
Provider-agnostic questions covering identity, data exposure, workload isolation, detection and recovery. Most cloud breaches are configuration, not exploitation — these are the configurations that matter.
22 questions. Nothing is sent anywhere as you answer — the scoring runs in your browser, and we only receive anything if you ask for the written version at the end.
Identity and access
Who can act in your cloud, and with what.
Is MFA enforced on every account with console or administrative access, including the root or global admin account?
Have long-lived static access keys been replaced with short-lived or federated credentials?
Leaked long-lived keys are the most common route into a cloud tenancy.
Are permissions scoped to roles rather than granting broad administrator rights?
Is privileged access time-bound and approved rather than standing?
Are service accounts inventoried with an owner for each?
Data protection
Where the data is, who can reach it, and whether it is encrypted.
Have you confirmed that no storage bucket, blob container or database is publicly accessible unless deliberately published?
Is data encrypted at rest with keys you control or can rotate?
Is TLS enforced for all data in transit, including internal service-to-service traffic?
Do you know which regions your data resides in, and is that consistent with your contractual commitments?
Are secrets held in a managed secrets store rather than in environment variables, code or CI configuration?
Network and workload
What is exposed, and what an attacker reaches if one workload falls.
Are production workloads in separate accounts, subscriptions or projects from development?
Are security groups and firewall rules restricted to required ports and sources, with no 0.0.0.0/0 on admin ports?
Are container images and virtual machine images scanned for known vulnerabilities before deployment?
Is infrastructure defined as code, so drift is detectable?
Logging and detection
Whether you would know.
Is cloud audit logging enabled across all accounts and regions, and shipped somewhere it cannot be deleted by a compromised account?
Is the provider's native threat detection service enabled and monitored?
Do configuration changes to security controls raise an alert?
Is there a documented cloud incident response runbook, including how to revoke credentials at speed?
Resilience and governance
Recovering, and not paying for surprises.
Are backups held in a separate account or tenancy so ransomware in production cannot reach them?
Has a restore been tested end to end in the last 12 months?
Are guardrails enforced centrally through policy rather than relying on individual discipline?
Are cost and usage anomalies alerted on? Unexpected spend is often the first sign of cryptomining after a compromise.