cloud-securitylisted

Use when assessing cloud infrastructure for security misconfigurations, IAM privilege-escalation paths, S3 public exposure, open security-group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture. For active cloud compromise, use `incident-response`. For behavioural anomalies, use `threat-detection`.
tmj-90/gaffer · ★ 0 · DevOps & Infrastructure · score 69

Install: claude install-skill tmj-90/gaffer

# Assess cloud posture before attackers do Cloud misconfigurations are the most common initial-access vector. Find them in review, not in an incident. ## The four critical categories | Category | Most common mistake | Check | |----------|---------------------|-------| | **IAM** | Privilege escalation via `PassRole` + `AssumeRole` + wildcard policies | No `*` on `Action` without explicit justification; no inline policies | | **Storage** | Public S3 / GCS / Azure Blob | Block Public Access enabled; no `*` principal in bucket policies | | **Network** | `0.0.0.0/0` ingress on admin ports | No open 22/3389 to internet; VPC peering limited to known CIDRs | | **IaC** | Secrets in `.tf`/`.yml` | No hardcoded credentials; no `var` with default that contains a secret | ## IAM analysis Work the privilege-escalation graph: 1. What actions does this principal have? 2. Can it `iam:PassRole` to a more-privileged role? 3. Can it `sts:AssumeRole` on a wildcard or overly-permissive trust policy? 4. Does it have `*` on resource for any action? Principle of least privilege: every principal has only the permissions it needs to perform its function, nothing more. ## S3 / storage - `BlockPublicAcls: true`, `BlockPublicPolicy: true`, `IgnorePublicAcls: true`, `RestrictPublicBuckets: true` — all four on every bucket unless public hosting is the explicit purpose. - Bucket policy principal `"*"` (unauthenticated) is a BLOCK finding unless the bucket is a public CDN origin. - Server-side encryp