Cloud Infrastructure Audit
Diese Seite ist auch auf Deutsch verfügbar.
Cloud services offer enormous flexibility — but that flexibility comes with risk. Misconfigured storage buckets, overly permissive IAM roles, and exposed management interfaces are among the most common causes of cloud security incidents. A Cloud Infrastructure Audit reviews your cloud environment with a read-only account to identify exactly these issues before attackers do.
Supported platforms: Azure, AWS, and GCP.
Scope
This audit is performed as a white-box engagement using a read-only account and standard tooling (ScoutSuite, manual review). The following areas are covered:
- Identity and Access Management — role assignments, over-privileged accounts, service principals, least-privilege review
- Storage and data exposure — public buckets/blobs, access policies, sensitive data exposure
- Virtual Network Configuration — security groups, network ACLs, firewall rules, exposure of management ports
- Logging and Monitoring — audit log configuration, alerting, detection coverage
- Security Settings — Defender/Security Hub/Security Command Center configuration, encryption at rest and in transit
- Service-specific hardening — configuration of the cloud services actively used in your environment
Why
- Cloud environments are a frequent source of breaches — often because default configurations are not hardened
- IAM mistakes (e.g. overly broad roles, unused service accounts with high permissions) are the most common cloud security gap
- A read-only configuration review can surface critical exposures in hours that might otherwise go unnoticed for months
Why VidraSec 🦦
I have conducted Cloud Infrastructure Audits across Azure, AWS, and GCP environments. My background in identity and access management — particularly in the Microsoft stack — extends naturally into cloud IAM, where many of the same misconfigurations appear.
Typical Duration
3–5 days (scope-dependent — depends on the number and complexity of cloud services in use). Reporting takes roughly 30–50% of the test time on top.
Typical Price
from 7,000 €
The final price depends on the scope of the project and the maturity level of your IT security. It is calculated individually based on the required effort.
Deliverables
Every engagement includes:
- Written findings report with all misconfigurations, prioritized by severity, with remediation steps
- Management summary tailored to your audience (technical or executive)
- Live debriefing to walk through findings and answer questions
- Retesting after remediation available on request
See example reports for what a VidraSec report looks like.
Compliance
Directly relevant for NIS2 and ISO 27001. Cloud configuration is increasingly scrutinized in information security management reviews.
martin@vidrasec.com | +43 670 3081275 | +43 670 3081275 | Book appointment |