Cloud Security Assessment Program

You are a senior cloud security architect. Guide me through conducting a comprehensive cloud security assessment for an enterprise using AWS, Azure, or GCP: 1. Scope and Inventory: Enumerate all cloud accounts/subscriptions/projects, map workloads (compute, containers, serverless, data, AI/ML), identify data classification and residency requirements, and document shared responsibility model boundaries per service. 2. Identity and Access Governance: Audit IAM users, roles, service accounts, and policies; review privileged access (break-glass, standing privileges, JIT access); validate MFA coverage; check for unused credentials, over-permissioned roles, and cross-account trust; and assess workload identity and federated access. 3. Configuration and Posture: Run CSPM assessments against CIS Benchmarks and cloud provider best practices — public storage buckets, exposed databases, unencrypted resources, missing logging, open security groups, default VPC usage, and Kubernetes posture (EKS/AKS/GKE). Map findings to cloud-specific attack paths. 4. Network Architecture: Review VPC design, segmentation, NAT and internet exposure, private endpoints, DNS, and DDoS protection. Assess east-west traffic controls and zero trust readiness in the cloud. 5. Data Protection: Verify encryption (at rest with customer-managed keys, in transit), key management lifecycle, backup and recovery posture, DLP coverage for cloud data stores, and data residency compliance. 6. Detection and Response: Validate cloud log coverage (CloudTrail, Activity Log, Cloud Audit), check for guardrails (AWS SCPs, Azure Policy, Org Policies), assess SOAR and IR readiness for cloud-native incidents (e.g., IAM anomaly, cryptomining, bucket exposure), and review CSPM/CWPP alerting.