ctest

Cloud pentests are automated across AWS, GCP, and Azure by orchestrating a structured 5-phase workflow covering discovery, IAM analysis, service exploitation, container testing, and reporting. The framework requires cloud CLI tools and proper authorization to manage engagement state and find misconfigurations.

IAM weaknesses are identified during the IAM and Access phase through automated enumeration and analysis of cloud credentials. This phase maps permissions and access controls, guiding metadata probing and RBAC testing to detect misconfigurations before advancing via gate checks.

Container and orchestration security is tested during a dedicated phase that evaluates RBAC configurations and container service exploitation. This structured approach ensures container vulnerabilities are checked alongside service and IAM misconfigurations before final reporting.

Cloud CLI tools including aws, gcloud, and az are required prerequisites to execute the security assessments. The framework relies on these CLIs for credential discovery, service exploitation, and state management throughout the gated workflow phases.

Gate-driven progress enforces structured advancement through the five assessment phases by validating state and findings before proceeding. It includes abandon and pivot heuristics to optimize engagement efficiency when misconfigurations or blockages occur during testing.

Cloud security assessments lack reproducibility without centralized state management and structured logging. This framework solves the problem by maintaining a state.yaml file, scope.md, and findings-log.md to track artifacts and gate checks across the entire engagement.