Cloud security audit

Cloud security audit for AWS, Azure, GCP and Microsoft 365.

Most cloud breaches come from configuration, not from the provider: an over-privileged account, a public storage bucket, an admin without MFA. I review your setup and show which gaps really matter.

Certified CCSK v5 by the Cloud Security Alliance, with every finding mapped to a concrete fix in your console.

Book a free 30-min callWhat I review
At a glance
Platforms
AWS · Azure · GCP · Microsoft 365
Access
Read-only audit account
Reference
CIS Benchmarks · CSA guidance
Deliverable
Report, debrief and retest
01 / Scope

What I review

The areas where a single misconfiguration can expose everything.

Identity and access

Admins without MFA, dormant accounts, over-broad roles and access keys that never rotate.

Exposed data

Public buckets and blobs, open sharing links, snapshots and databases reachable from the internet.

Microsoft 365

Conditional access, legacy authentication, mail forwarding rules, external sharing in SharePoint and Teams.

Logging and detection

Whether you would actually notice an intrusion: audit logs, alerts and how long evidence is kept.

02 / Method

How a cloud audit runs

Nothing in your environment is modified during the audit.

  1. Scoping. Accounts, subscriptions, projects or tenants in scope, and who to contact.
  2. Read-only access. You create a read-only audit account. I never need admin rights.
  3. Configuration review. Automated checks against CIS Benchmarks, then a manual review focused on what matters for your business.
  4. Attack paths. How a stolen password or leaked key could turn into a full account takeover, shown step by step.
  5. Report, debrief and retest. Findings ranked by risk with the exact setting to change, a debrief call, then verification of your fixes.
03 / Typical findings

What cloud audits often reveal

Small settings, large consequences.

Admins without MFA

Global or root administrators protected only by a password, sometimes shared between several people.

Public storage

Files meant for internal use, reachable by anyone who has or guesses the link.

Over-privileged identities

Applications and users with far more rights than they need, and long-lived keys stored in code.

Missing logs

Audit logging disabled or kept too briefly to investigate an incident.

04 / FAQ

Cloud security audit: your questions

Do you need admin access?

No. A read-only account is enough for the review, and nothing is changed in your environment.

Is this a pentest of AWS or Microsoft themselves?

No. I assess your own configuration and resources, within the rules each cloud provider sets for security testing.

We only use Microsoft 365. Is it relevant?

Yes. For many SMEs, Microsoft 365 holds email, files and identities: it is often the most valuable target and the easiest to misconfigure.

Does it help with ISO 27001 or NIS2?

The findings map to common security controls and give you evidence of what was checked and fixed. It is not a certification in itself.

Want to know where your cloud is exposed?

Tell me which platforms you use. You get a fixed-price proposal after a free 30-minute call.

Book a free callAll services