Cloud methodology
Cloud assessment: what we need from you

Cloud pentest prerequisites

PentestMe's cloud assessment is a credentialed configuration & posture review, run with industry-standard auditors (Prowler, ScoutSuite, and kube-bench) against CIS Benchmarks and cloud best practice. It authenticates with the read-only credentials you provide and inspects identity/IAM, public storage, network exposure, encryption, logging/monitoring, secrets exposure, and compliance gaps. It is read-only. It never modifies resources or runs intrusive attacks against your control plane.

Pick your provider below, create a dedicated read-only credential (steps included), then paste the listed fields into the scan's Credentials step and run the live Test connection check before you queue the scan.

AWS

A read-only IAM access key (or a cross-account read-only role).

Runs: Prowler + IAM privilege-escalation analysis

Create the credential

  1. IAM → Users → Create user (e.g. "pentestme-readonly"), with no console access.
  2. Attach these AWS-managed, read-only policies: SecurityAudit and job-function/ViewOnlyAccess.
  3. Create an access key (type: Third-party service / CLI) and copy the Access Key ID and Secret Access Key.

Paste these fields

  • AWS Access Key ID· starts with AKIA…
  • AWS Secret Access Key
  • AWS Region· optional (defaults to us-east-1; IAM/global checks always run)
  • Cross-account Role ARN + External ID· optional, for org-wide audits

Note: Org-wide instead? Create the read-only role (SecurityAudit + ViewOnlyAccess) in the target account with a trust policy to your auditing principal and an External ID, then paste the Role ARN (+ External ID) here.

Azure

An App Registration (service principal) with Reader on the subscription.

Runs: ScoutSuite

Create the credential

  1. Microsoft Entra ID → App registrations → New registration (e.g. "pentestme-readonly").
  2. Add a credential: Certificates & secrets → New client secret → copy the Value (or upload a certificate and keep the matching PEM).
  3. Subscriptions → your subscription → Access control (IAM) → Add role assignment → Reader (required) + Security Reader (recommended).
  4. For identity/Entra checks: Microsoft Graph → Directory.Read.All (application permission) → Grant admin consent.

Paste these fields

  • Tenant ID· Entra ID → Overview
  • Client (Application) ID· App registration → Overview
  • Subscription ID
  • Client Secret or Certificate (PEM)· the secret Value, or the PEM private key + cert

Google Cloud (GCP)

A service account with read-only roles and a JSON key.

Runs: ScoutSuite

Create the credential

  1. IAM & Admin → Service Accounts → Create service account (e.g. "pentestme-readonly").
  2. Grant it, at the project (or organization) you want assessed: roles/viewer and roles/iam.securityReviewer.
  3. Keys → Add key → Create new key → JSON → download the key file.

Paste these fields

  • Service Account Key (JSON)· paste the entire contents of the downloaded JSON key file

Kubernetes

A kubeconfig bound to a read-only ServiceAccount.

Runs: kube-bench + kube-hunter

Create the credential

  1. kubectl create serviceaccount pentestme-readonly -n kube-system
  2. kubectl create clusterrolebinding pentestme-readonly --clusterrole=view --serviceaccount=kube-system:pentestme-readonly (use cluster-reader on OpenShift)
  3. Produce a kubeconfig for that ServiceAccount's token, pointing at your cluster's API server endpoint.

Paste these fields

  • Kubeconfig (YAML)· the full kubeconfig for the read-only ServiceAccount

Note: If the API server is private / not internet-reachable, attach a VPN connection to the engagement so our worker can reach it. Tell us and we’ll set up the tunnel with you.

Microsoft 365 / Entra ID

An App Registration with read-only Microsoft Graph application permissions + admin consent.

Runs: Prowler + ROADtools / AzureHound

Create the credential

  1. Entra ID → App registrations → New registration (e.g. "pentestme-m365").
  2. Certificates & secrets → New client secret → copy the Value.
  3. API permissions → Microsoft Graph → Application permissions → add (all read-only): Directory.Read.All, Policy.Read.All, Reports.Read.All, SecurityEvents.Read.All, Mail.Read, Sites.Read.All.
  4. Grant admin consent for your tenant.

Paste these fields

  • Tenant ID· Entra ID → Overview
  • Application (Client) ID
  • Client Secret· the secret Value

Verify before you scan

After entering your credentials, click Test connection. We run a live, read-only authentication check (e.g. AWS STS GetCallerIdentity, an Azure/Microsoft Graph token request, a GCP token exchange, or a Kubernetes API /version probe) and tell you exactly what to fix (wrong key, missing role, expired secret) before the scan is queued. Nothing is read from your environment until this passes.

How we handle your credentials

Least-privilege, read-only, and short-lived by design.

  • Use dedicated, least-privilege credentials created for this engagement, never a personal admin login or long-lived org-admin keys.
  • Credentials are encrypted at rest (AES-256-GCM), decrypted only for the scan, written to 0600 temp files inside the scanner that are shredded on exit, and never logged.
  • Everything is read-only. We never alter your environment.
  • Revoke / delete the credential (access key, client secret, SA key, ServiceAccount) as soon as the assessment is complete.

Ready to assess your cloud?

Set up your read-only credential, paste it into a new cloud scan, and run the connection test. We'll take it from there.

Start a cloud scanSee the cloud methodology