# Check for root account MFA
aws iam get-account-summary | grep AccountMFAEnabled

# List IAM users without MFA enabled
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d | \
  awk -F, '$4 == "false" && $2 == "true" {print $1}'  # users with console access, no MFA

# Find overly permissive policies (attached policies with *)
aws iam list-policies --scope Local --query \
  'Policies[*].{Name:PolicyName, Arn:Arn}' --output table

# Find access keys older than 90 days
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d | \
  awk -F, '{print $1,$9,$10}' | grep -v N/A

// BAD - full admin on everything
{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*"
}

// BETTER - specific permissions scoped to specific resources
{
  "Effect": "Allow",
  "Action": ["s3:GetObject", "s3:PutObject"],
  "Resource": "arn:aws:s3:::my-specific-bucket/*"
}

# List all role assignments (look for overly broad assignments)
az role assignment list --all --output table

# Check for accounts with Owner or Contributor at subscription scope
az role assignment list --all --query \
  "[?roleDefinitionName=='Owner' || roleDefinitionName=='Contributor']" --output table

# List service principals and their permissions
az ad sp list --all --output table

# List all IAM policies at project level
gcloud projects get-iam-policy YOUR_PROJECT_ID

# Find service accounts with editor/owner roles
gcloud projects get-iam-policy YOUR_PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.role:roles/editor OR bindings.role:roles/owner"

# List service account keys (should be minimal)
gcloud iam service-accounts list
gcloud iam service-accounts keys list --iam-account=SA_EMAIL

# List all buckets and their public access settings
aws s3api list-buckets --query 'Buckets[*].Name' --output text | \
  xargs -I{} aws s3api get-public-access-block --bucket {}

# Enable block public access at the account level (applies to all buckets)
aws s3control put-public-access-block \
  --account-id YOUR_ACCOUNT_ID \
  --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

# Check a specific bucket's ACL
aws s3api get-bucket-acl --bucket YOUR_BUCKET_NAME

# Enable versioning (helps with ransomware recovery)
aws s3api put-bucket-versioning \
  --bucket YOUR_BUCKET_NAME \
  --versioning-configuration Status=Enabled

# Enable server-side encryption
aws s3api put-bucket-encryption \
  --bucket YOUR_BUCKET_NAME \
  --server-side-encryption-configuration \
    '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms"}}]}'

# Enable access logging
aws s3api put-bucket-logging \
  --bucket YOUR_BUCKET_NAME \
  --bucket-logging-status \
    '{"LoggingEnabled":{"TargetBucket":"YOUR_LOG_BUCKET","TargetPrefix":"s3-access-logs/"}}'

# Disable public blob access at storage account level
az storage account update \
  --name YOUR_STORAGE_ACCOUNT \
  --resource-group YOUR_RG \
  --allow-blob-public-access false

# Enable soft delete for blobs (recovery from accidental deletion/ransomware)
az storage blob service-properties delete-policy update \
  --account-name YOUR_STORAGE_ACCOUNT \
  --enable true \
  --days-retained 30

# Enforce HTTPS-only access
az storage account update \
  --name YOUR_STORAGE_ACCOUNT \
  --resource-group YOUR_RG \
  --https-only true

# AWS - Find security groups allowing 0.0.0.0/0 on SSH
aws ec2 describe-security-groups \
  --filters "Name=ip-permission.from-port,Values=22" \
             "Name=ip-permission.to-port,Values=22" \
             "Name=ip-permission.cidr,Values=0.0.0.0/0" \
  --query 'SecurityGroups[*].{ID:GroupId, Name:GroupName}'

# Same for RDP
aws ec2 describe-security-groups \
  --filters "Name=ip-permission.from-port,Values=3389" \
             "Name=ip-permission.to-port,Values=3389" \
             "Name=ip-permission.cidr,Values=0.0.0.0/0" \
  --query 'SecurityGroups[*].{ID:GroupId, Name:GroupName}'

# GCP - List firewall rules allowing SSH from everywhere
gcloud compute firewall-rules list \
  --filter="allowed[].ports:22 AND sourceRanges:0.0.0.0/0"

# AWS SSM Session Manager - connect without opening port 22
aws ssm start-session --target i-0123456789abcdef0

# GCP IAP tunnel
gcloud compute ssh INSTANCE_NAME \
  --tunnel-through-iap \
  --project YOUR_PROJECT \
  --zone YOUR_ZONE

# AWS - Enforce IMDSv2 (token-required mode) on existing instance
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1

# Enforce IMDSv2 at account level for all new instances
aws ec2-instance-connect send-ssh-public-key # example - use account policy instead:
# Set account-level default: require IMDSv2 on all new instances

# Check if default VPC exists in each region (best practice: delete it or don't use it)
aws ec2 describe-vpcs --filters "Name=isDefault,Values=true" --query 'Vpcs[*].VpcId'

# Enable VPC Flow Logs
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-0123456789abcdef0 \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /aws/vpc/flowlogs

# Check Network ACLs - find permissive rules
aws ec2 describe-network-acls \
  --query 'NetworkAcls[*].{ID:NetworkAclId, Entries:Entries}'

Security group rules:
- Inbound: Deny all by default, allow only what's needed
- Outbound: Consider restricting outbound too (not just inbound)
- Reference security groups by ID, not IP ranges, for internal traffic
- Use separate security groups for different application tiers
- Never use the "default" security group for production resources
- Document every inbound rule with a purpose/owner

# Verify CloudTrail is enabled and logging in all regions
aws cloudtrail describe-trails --include-shadow-trails

# Check if CloudTrail log validation is enabled
aws cloudtrail get-trail-status --name YOUR_TRAIL_NAME \
  --query 'IsLogging'

# Enable CloudTrail in all regions with log file validation
aws cloudtrail create-trail \
  --name all-regions-trail \
  --s3-bucket-name YOUR_CLOUDTRAIL_BUCKET \
  --is-multi-region-trail \
  --enable-log-file-validation

aws cloudtrail start-logging --name all-regions-trail

# Enable GuardDuty
aws guardduty create-detector --enable --finding-publishing-frequency FIFTEEN_MINUTES

# List active detectors
aws guardduty list-detectors

# List findings
aws guardduty list-findings \
  --detector-id YOUR_DETECTOR_ID \
  --finding-criteria '{"Criterion":{"severity":{"Gte":4}}}'

# Enable Security Hub
aws securityhub enable-security-hub --enable-default-standards

# Enable specific standards
aws securityhub batch-enable-standards \
  --standards-subscription-requests \
    StandardsArn=arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0

# Get all failed controls
aws securityhub get-findings \
  --filters '{"ComplianceStatus":[{"Value":"FAILED","Comparison":"EQUALS"}]}'

# AWS - Check if EBS volumes are encrypted
aws ec2 describe-volumes \
  --query 'Volumes[?Encrypted==`false`].{ID:VolumeId, State:State}'

# Enforce encryption of all new EBS volumes at account level
aws ec2 enable-ebs-encryption-by-default

# Check RDS encryption status
aws rds describe-db-instances \
  --query 'DBInstances[?StorageEncrypted==`false`].DBInstanceIdentifier'

# AWS - Check ALB listeners for HTTP (non-HTTPS)
aws elbv2 describe-listeners \
  --query 'Listeners[?Protocol==`HTTP`].{ARN:ListenerArn, Port:Port}'

# Enforce HTTPS-only on an ALB by adding a redirect rule
aws elbv2 create-rule \
  --listener-arn YOUR_HTTP_LISTENER_ARN \
  --conditions Field=path-pattern,Values='/*' \
  --priority 1 \
  --actions Type=redirect,RedirectConfig='{Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'

# Install Prowler
pip install prowler

# Run against AWS with CIS benchmark
prowler aws --compliance cis_level1_aws

# Run against specific checks
prowler aws --checks s3_bucket_public_access_block

# Output to HTML report
prowler aws --output-formats html --output-directory ./prowler-results

# Scan container images for vulnerabilities before pushing
trivy image your-image:tag

# Scan a Kubernetes cluster for misconfigurations
trivy k8s --report all cluster

# Run kube-bench to check CIS Kubernetes benchmark compliance
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job.batch/kube-bench

# Never hardcode credentials in code or pipelines
# BAD:
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=abc123...

# GOOD: Use IAM roles for EC2/Lambda, OIDC for GitHub Actions/GitLab CI

# AWS - Retrieve a secret at runtime (not at deploy time)
aws secretsmanager get-secret-value --secret-id my-db-password

# Rotate a secret
aws secretsmanager rotate-secret --secret-id my-db-password

# Detect secrets in code
pip install detect-secrets
detect-secrets scan --all-files > .secrets.baseline

# Scan git history for leaked credentials
trufflehog git https://github.com/your-org/your-repo