Runbook 01 — Cloud Security Assessment

This runbook provides a repeatable professional workflow for assessing the security posture of a cloud environment.

Use it when reviewing:

AWS

Microsoft Azure

Google Cloud

Private Cloud

Hybrid Cloud

Multi-Cloud

The runbook is vendor-neutral.

Its purpose is to help you answer:

What exists?

What is exposed?

Who has access?

Where is sensitive data?

Which controls are missing?

What is the business risk?

What should be remediated first?

Runbook Purpose

This runbook standardizes the transition from:

Cloud Environment
      ↓
Security Review
      ↓
Validated Findings
      ↓
Risk Prioritization
      ↓
Remediation
      ↓
Management Reporting

Use it to avoid ad hoc assessments where different analysts review different controls every time.

Runbook Scope

This runbook covers:

Cloud governance
Asset inventory
Shared responsibility
Identity and access
Privileged access
Network security
Workload security
Data protection
Encryption
Key management
Logging
Detection
Vulnerability management
Backup and resilience
Incident readiness
Risk assessment
Remediation planning

Runbook Inputs

Before starting, obtain as much of the following as possible:

Cloud Architecture Diagram

Account / Subscription / Project Inventory

Asset Inventory

IAM Export

Network Diagram

Data Classification

Logging Architecture

Backup Architecture

Security Policies

Risk Register

Previous Assessment Reports

Runbook Outputs

At completion, produce:

Cloud Security Assessment Report

Risk Register

Finding Register

Remediation Roadmap

Executive Summary

Assessment Workflow

Use the following sequence:

01 Confirm Scope
      ↓
02 Understand Business Context
      ↓
03 Inventory Cloud Assets
      ↓
04 Confirm Shared Responsibility
      ↓
05 Review Governance
      ↓
06 Review Identity
      ↓
07 Review Privileged Access
      ↓
08 Review Network Security
      ↓
09 Review Workloads
      ↓
10 Review Data Protection
      ↓
11 Review Encryption and Keys
      ↓
12 Review Logging
      ↓
13 Review Detection
      ↓
14 Review Vulnerability Management
      ↓
15 Review Backup and Resilience
      ↓
16 Review Incident Readiness
      ↓
17 Identify Findings
      ↓
18 Rate Risk
      ↓
19 Prioritize Remediation
      ↓
20 Report

Step 01 — Confirm Assessment Scope

Document exactly what is included.

Capture:

Cloud Provider

Accounts / Subscriptions / Projects

Regions

Applications

Networks

Data Stores

User Populations

Administrative Systems

Third-Party Integrations

Scope Template

Assessment Name:

Business Unit:

Cloud Environment:

Production / Development:

Accounts / Subscriptions / Projects:

Applications:

Critical Data:

Excluded Areas:

Assessment Owner:

Assessment Date:

Scope Validation Questions

Ask:

Are all production environments included?

Are shared services included?

Are security accounts included?

Are external integrations included?

Are development environments excluded intentionally?

Stop Condition

Do not proceed with a high-confidence assessment if the environment boundary is unknown.

Mark missing visibility as an assessment limitation.

Step 02 — Understand Business Context

Security risk should be evaluated against business impact.

Document:

Business Service

Criticality

Data Sensitivity

Availability Requirement

Primary Users

Major Dependencies

Business Context Questions

Ask:

What business process depends on this environment?

What happens if the service is unavailable?

What happens if data is exposed?

What happens if an administrator is compromised?

Which systems are considered critical?

Business Criticality

Use:

Low

Medium

High

Critical

Example

Service:
Customer Portal

Criticality:
Critical

Data:
Customer PII

Availability:
24x7

Primary Risk:
Unauthorized access and service disruption

Step 03 — Inventory Cloud Assets

Identify what exists before assessing how it is secured.

Capture:

Compute
Storage
Databases
Networks
Load balancers
IAM resources
Containers
Kubernetes
Serverless
Secrets
Keys
Logs
Backups

Asset Inventory Template

Asset	Type	Environment	Owner	Exposure	Criticality
Customer Portal	Application	Production	App Team	Public	Critical
Customer DB	Database	Production	Data Team	Private	Critical
Admin Identity	IAM	Production	Cloud Team	Management	Critical

Asset Review Questions

Ask:

Does every asset have an owner?

Does every production asset have a purpose?

Are unused resources present?

Are legacy resources still active?

Are temporary resources still deployed?

Red Flags

Look for:

Unknown Owner

Unknown Purpose

Old Test Resources

Orphaned Storage

Unused Public IPs

Legacy Snapshots

Step 04 — Confirm Shared Responsibility

Determine what the provider manages and what the customer manages.

Review:

IaaS

PaaS

SaaS

Managed Services

Shared Responsibility Matrix

Control Area	Provider	Customer	Shared
Physical infrastructure	✓
IAM configuration		✓
Application security		✓
Data protection			✓
Service availability	✓		✓

Validate the exact responsibility model for the service being assessed.

Key Question

For every security control ask:

Who owns this?

Red Flag

Nobody Can Clearly Identify
the Responsible Party

This may indicate a control gap.

Step 05 — Review Cloud Governance

Assess whether the environment is governed consistently.

Review:

Account structure
Resource organization
Naming standards
Tagging
Security policies
Approved regions
Baselines
Exceptions
Ownership

Governance Questions

Ask:

Who can create cloud environments?

Who approves production resources?

Are security standards defined?

Are exceptions documented?

Are resources tagged with ownership?

Account Segregation

Review whether environments are deliberately separated.

Example:

Production
Development
Security
Shared Services

Avoid uncontrolled mixing of:

Production
+
Testing
+
Personal Experiments

Governance Finding Example

Finding:
Cloud resources lack consistent ownership tags.

Risk:
Security and operations teams may be unable
to rapidly identify responsible owners during incidents.

Recommendation:
Establish mandatory ownership and environment tagging.

Step 06 — Review Identity and Access

IAM should be treated as a primary cloud security control plane.

Review:

Users

Groups

Roles

Policies

Service Identities

Workload Identities

Federation

External Identities

IAM Review Questions

Ask:

Who has access?

Why?

How was access granted?

How is access reviewed?

Is the access still required?

Human Identity Review

Check for:

Former employees
Dormant users
Contractors
Guest accounts
Shared accounts

Authentication Review

Check:

MFA

Federation

SSO

Legacy Authentication

Session Controls

High-Priority Control

Privileged identities should receive strong authentication appropriate to risk.

Authorization Review

Look for:

Full Administrator Roles

Wildcard Permissions

Direct User Permissions

Excessive Group Membership

Unused High Privilege

Least Privilege Test

For each high-risk role ask:

What exact business function requires this access?

Step 07 — Review Privileged Access

Identify every high-privilege identity.

Examples:

Global Administrator

Cloud Administrator

IAM Administrator

Security Administrator

Database Administrator

Privileged Access Checklist

Standing Privilege

Flag unnecessary:

Permanent Administrator

where temporary privilege is feasible.

Privileged Access Flow

Preferred model:

Administrator
      ↓
Strong Authentication
      ↓
Approval / Policy
      ↓
Temporary Privilege
      ↓
Administrative Action
      ↓
Audit

Critical Red Flags

Privileged Account Without MFA

Shared Administrator Account

Former Employee With Admin Access

Unknown High-Privilege Identity

Step 08 — Review Network Security

Review:

Virtual Networks

Subnets

Routes

Firewalls

Security Rules

Public IPs

Private Endpoints

Hybrid Connectivity

Egress

Public Exposure Review

List every public resource.

For each ask:

Why is this public?

Which service is exposed?

Who needs access?

Can private connectivity be used?

Public Exposure Matrix

Resource	Public	Required?	Risk
Web Application	Yes	Yes	Expected
Database	Yes	No	Critical
Admin Interface	Yes	Review	High

Firewall Review

Look for overly broad patterns such as:

Source:
Any

Destination:
Sensitive Resource

Action:
Allow

Segmentation Review

Preferred:

Internet
   ↓
Web Tier
   ↓
Application Tier
   ↓
Data Tier

Avoid unnecessarily flat architecture.

Administrative Network Access

Review whether administration is exposed directly to the internet.

Preferred:

Administrator
      ↓
Strong Authentication
      ↓
Controlled Management Path
      ↓
Target

Egress Review

Ask:

Which workloads can access the internet?

Why?

Are outbound destinations restricted?

Could compromised workloads exfiltrate data?

Network Red Flags

Public Database

Open Administrative Ports

Any-to-Any Firewall Rules

Flat Network

Unrestricted Egress

Step 09 — Review Workload Security

Assess:

Virtual Machines

Containers

Kubernetes

Serverless

Managed Platforms

Virtual Machine Checklist

Unsupported Workloads

Flag:

Unsupported Operating System

Unsupported Runtime

End-of-Life Software

Container Review

Assess:

Image Source

Image Vulnerabilities

Registry Access

Secrets

Runtime Privilege

Logging

Kubernetes Review

Review:

RBAC
Service accounts
Workload identity
Secrets
Network policies
Admission controls
Audit logging

Serverless Review

Review:

Function IAM

External Triggers

Secrets

Data Access

Logging

Workload Red Flags

Root / High Privilege

Public Administrative Access

Unpatched Workload

Embedded Secret

Unknown Image Source

Step 10 — Review Data Protection

Identify all sensitive cloud data.

Classify:

Public

Internal

Confidential

Restricted

Data Review Questions

Ask:

Where is sensitive data stored?

Who can access it?

Is it publicly exposed?

Is it encrypted?

Where are backups stored?

How long is it retained?

Data State Review

Assess:

Data at Rest

Data in Transit

Data in Use

Storage Review

Check:

Public access
Anonymous access
Cross-account access
Encryption
Logging
Retention

Database Review

Check:

Network exposure
IAM
Encryption
Administrative access
Logging
Backup

Data Protection Red Flags

Public Sensitive Storage

Unencrypted Sensitive Data

Excessive Database Access

Unprotected Backup

Unknown Data Owner

Step 11 — Review Encryption and Key Management

Do not stop at:

Encryption Enabled

Review the full key lifecycle.

Generate
 ↓
Store
 ↓
Use
 ↓
Rotate
 ↓
Revoke
 ↓
Destroy

Key Questions

Ask:

Who owns the key?

Who can administer it?

Who can use it?

Who can disable it?

Who can destroy it?

Are these actions logged?

Separation of Duties

Where justified, separate:

Data Administration

from:

Key Administration

Key Red Flags

One Identity Controls Data and Keys

Unused Keys

Unrestricted Key Administration

Missing Key Logging

Step 12 — Review Logging

Ensure the environment generates appropriate security telemetry.

Review:

Authentication

Administrative Activity

IAM Changes

Network Activity

Application Activity

Data Access

Logging Questions

Ask:

Which logs are enabled?

Where are they stored?

How long are they retained?

Who can delete them?

Are they centralized?

Centralized Architecture

IAM ──────────────┐
Network ──────────┤
Cloud Audit ──────┼──→ Central Logging
Application ──────┤
Database ─────────┘

Log Protection

Security logs should not be easily modified by the same administrators being monitored.

Logging Red Flags

Audit Logging Disabled

Short Retention

Local Logs Only

Administrators Can Delete Evidence

Missing Data Access Logs

Step 13 — Review Detection

Logging without monitoring creates limited active defense.

Ask:

Which critical events generate alerts?

Recommended Detection Areas

Review whether detections exist for:

New Administrator

Privilege Escalation

MFA Disabled

Logging Disabled

Public Resource Created

Firewall Rule Opened

Unusual Authentication

Detection Mapping

Threat	Detection
Account compromise	Suspicious authentication
Privilege escalation	Admin role assignment
Exposure	Public resource creation
Defense evasion	Logging disabled
Network change	Broad firewall rule

Detection Red Flags

Logs Exist but No Alerts

No Privileged Activity Monitoring

No Public Exposure Detection

No IAM Change Detection

Step 14 — Review Vulnerability Management

Assess how cloud workload vulnerabilities are managed.

Review:

Discovery

Prioritization

Remediation

Exceptions

Validation

Vulnerability Coverage

Check:

Virtual machines
Containers
Applications
Dependencies
Configuration weaknesses

Prioritization

Use:

Severity
   +
Exposure
   +
Exploitability
   +
Asset Criticality
   +
Threat Activity

Vulnerability Red Flags

Internet-Facing Critical Vulnerability

Unsupported Production System

Old Container Image

Large Overdue Backlog

Step 15 — Review Backup and Resilience

Cloud does not automatically provide complete business resilience.

Review:

Backup coverage
Backup protection
Restore testing
Redundancy
Recovery objectives
Critical dependencies

RTO

Ask:

How quickly must this system recover?

RPO

Ask:

How much data loss is acceptable?

Backup Validation

Require:

Backup Exists
      +
Backup Protected
      +
Restore Tested

Privilege Separation

Ask:

Can one compromised administrator
delete both production and backups?

Resilience Red Flags

No Tested Restore

Single Point of Failure

Unprotected Backup

Recovery Objectives Undefined

Step 16 — Review Incident Readiness

Determine whether the organization can respond to a cloud compromise.

Ask:

Who receives alerts?

Who can disable compromised identities?

Who can isolate resources?

Who can preserve evidence?

Who contacts the provider?

Incident Response Workflow

Alert
  ↓
Validate
  ↓
Identify Principal
  ↓
Review Activity
  ↓
Determine Scope
  ↓
Preserve Evidence
  ↓
Contain
  ↓
Recover

Evidence Sources

Possible evidence includes:

Authentication Logs

Cloud Audit Logs

Network Logs

Application Logs

Snapshots

Configuration History

Incident Readiness Checklist

Cloud incident contacts defined
IAM containment process defined
Workload isolation process defined
Evidence sources documented
Escalation process defined
Runbooks available

Incident Readiness Red Flags

No Cloud Runbook

Unknown Evidence Sources

No Authority to Disable Accounts

No Security Contact for Provider

Step 17 — Identify Findings

Every finding should be clear and evidence-based.

Use:

Finding

Affected Resource

Risk

Evidence

Recommendation

Priority

Finding Template

Finding:
[Security weakness]

Affected Resource:
[Cloud resource / environment]

Risk:
[Business and technical consequence]

Evidence:
[Validated observation]

Recommendation:
[Required remediation]

Priority:
[Critical / High / Medium / Low]

Example — Excessive Privilege

Finding:
Permanent Full Administrative Access

Affected Resource:
Production Cloud Environment

Risk:
Compromise of a standing administrator could
provide broad control of production resources.

Evidence:
Six users retain permanent full administrator roles.

Recommendation:
Validate business need,
reduce unnecessary privilege,
use temporary elevation where appropriate,
and monitor privileged activity.

Priority:
High

Example — Public Database

Finding:
Internet-Facing Sensitive Database

Affected Resource:
Customer Database

Risk:
Public exposure increases attack surface
against a critical data asset.

Evidence:
Database accepts network connections
from public address space.

Recommendation:
Remove unnecessary public access and require
approved private connectivity.

Priority:
Critical

Step 18 — Rate Risk

Use:

Likelihood
    +
Impact
    ↓
Risk

Qualitative Scale

Low

Medium

High

Critical

Risk Factors

Consider:

Exposure

Exploitability

Privilege

Asset Criticality

Data Sensitivity

Business Impact

Existing Controls

Risk Register Template

ID	Finding	Likelihood	Impact	Risk	Owner
R-001	Public DB	4	5	Critical	Data Owner
R-002	Missing Admin MFA	4	5	Critical	IAM Owner
R-003	Missing Logs	3	4	High	Security Owner

Inherent vs Residual Risk

Document where appropriate:

Inherent Risk
      ↓
Existing Controls
      ↓
Residual Risk

Step 19 — Prioritize Remediation

Use business risk rather than arbitrary ordering.

Immediate

Examples:

Remove Sensitive Public Exposure

Disable Compromised Credentials

Enforce Critical Admin Protection

Short Term

Examples:

Reduce Excessive Privilege

Enable Missing Logging

Patch Critical Systems

Medium Term

Examples:

Implement PAM

Improve Detection

Improve Segmentation

Standardize Baselines

Strategic

Examples:

Cloud Governance

Zero Trust

Automated Policy Enforcement

Central Security Architecture

Remediation Tracker

Finding	Priority	Owner	Action	Status
Public DB	Critical	Data Team	Remove public access	Open
Admin MFA	Critical	IAM	Enforce MFA	In Progress
Missing logs	High	Security	Centralize logging	Planned

Step 20 — Produce the Final Report

The final assessment should contain:

01 Executive Summary

02 Scope

03 Business Context

04 Architecture Overview

05 Asset Inventory

06 Governance Findings

07 IAM Findings

08 Network Findings

09 Workload Findings

10 Data Findings

11 Logging and Detection Findings

12 Resilience Findings

13 Incident Readiness

14 Risk Register

15 Remediation Roadmap

16 Assessment Limitations

Executive Summary Template

Assessment Objective:

Evaluate the security posture of the organization's
cloud environment.

Overall Risk Rating:

[Low / Moderate / High / Critical]

Key Risks:

1. [Risk]
2. [Risk]
3. [Risk]

Business Impact:

[Business-focused summary]

Immediate Actions:

1. [Action]
2. [Action]
3. [Action]

Strategic Recommendation:

[Longer-term program improvement]

Cloud Security Scorecard

Use a concise scorecard where useful.

Domain	Rating
Governance	Moderate
IAM	High Risk
Privileged Access	High Risk
Network	Moderate
Workloads	Moderate
Data Protection	High Risk
Logging	Moderate
Detection	High Risk
Resilience	Moderate
Incident Readiness	Moderate

Executive Communication Rule

Do not report only:

Security Group Allows 0.0.0.0/0

Translate it.

Example:

A production administrative service is reachable
from the public internet, increasing the likelihood
of unauthorized access attempts against a critical system.

Cloud Security Assessment Quick Checklist

Governance

IAM

Network

Workloads

Patch status reviewed
Secure baseline reviewed
Container security reviewed
Kubernetes reviewed where applicable
Serverless reviewed where applicable

Data

Monitoring

Resilience

Incident Readiness

Assessment Decision Framework

For every major observation, ask:

What is the asset?

What is the weakness?

What threat could exploit it?

What is the business impact?

What control exists?

What risk remains?

What should happen next?

Common Cloud Assessment Mistakes

Mistake 1 — Reviewing Only Configuration

Cloud security also includes:

Governance

Identity

Operations

Resilience

Risk

Mistake 2 — Ignoring Shared Responsibility

Never assume the provider manages every control.

Mistake 3 — Focusing Only on Public Exposure

Identity compromise can be equally or more damaging.

Mistake 4 — Ignoring Non-Human Identities

Service and workload identities may hold significant privilege.

Mistake 5 — Treating Logging as Detection

Logs must be monitored to support timely response.

Mistake 6 — Ignoring Backup Security

Backups are part of the attack surface.

Mistake 7 — Reporting Technical Findings Without Business Context

Always connect security weaknesses to risk.

Runbook Completion Criteria

The assessment is complete when:

Professional Outcome

This runbook gives you a repeatable approach for moving from:

Unknown Cloud Environment
        ↓
Structured Assessment
        ↓
Security Findings
        ↓
Business Risk
        ↓
Remediation Priorities
        ↓
Executive Reporting

A professional cloud security assessment should not end with:

Here are 100 configuration issues.

It should explain:

Which issues matter,

why they matter,

what could happen,

who owns the risk,

and what the organization should do next.

What’s Next?

➡️ Runbook 02 — IAM Security Review

In the next runbook, you will turn the IAM lab into a repeatable identity-security review process covering:

Identity Inventory
      ↓
Joiner-Mover-Leaver
      ↓
Authentication
      ↓
Authorization
      ↓
Privileged Access
      ↓
Service Identities
      ↓
Federation
      ↓
Access Reviews
      ↓
IAM Monitoring
      ↓
Risk and Remediation

The progression is:

Cloud Security Assessment
        ↓
Identify Identity Risk
        ↓
Perform Deep IAM Review