Cloud Security coverage by provider
The resources Cloud Security reads, how it resolves internet exposure, what each identity profile holds and how real-time changes arrive, for AWS, Google Cloud and Azure.
Cloud Security works the same way on every provider: each resource keeps its configuration with a version history, its tags or labels, its owner, environment and criticality, and the relationships that join it to the others. This page lists what differs by provider: the resources read, the elements that decide internet exposure, the identity profile, and how a change arrives in real time.
AWS
Resources
| Area | Resources |
|---|---|
| Identity | Users, roles, groups, policies and access keys |
| Network | VPCs, subnets, gateways, route tables, security groups, load balancers, API gateways and CloudFront |
| Compute | Instances, launch templates, containers, Lambda functions and EKS clusters |
| Storage and data | S3, RDS, DynamoDB, EFS, snapshots, KMS keys and secrets |
| Logging and detection | CloudTrail, Config, GuardDuty and Security Hub |
| AI services | Bedrock and SageMaker |
Exposure
The path from the internet is resolved through the gateway, the route table, the subnet, the security group, the network ACL and the address. Behind a network load balancer, the security group of the workload decides who gets through. A port your security group admits only from named sources is listed with those sources and the description of each rule, is not counted as open to the internet and is not probed; an administrative port allow-listed this way is a low hygiene risk, or a medium one when a source is a wide public range.
Identity profile
The effective privilege of each principal, the escalation paths it holds (passing a role to a compute service, rewriting a policy, assuming any role), the trust it extends outside your organization, dormant credentials and missing MFA.
Real-time changes
An EventBridge rule, created per region from the events template, sends configuration events only. A change is evaluated within seconds, with the actor and the tool that made it (console, API, CloudFormation, an IaC tool, a pipeline).
Google Cloud
Resources
| Area | Resources |
|---|---|
| Identity | The project and its IAM policy, service accounts and keys, custom roles, API keys, and workload identity pools and providers |
| Network | VPC networks, subnetworks, firewall rules, routes, Cloud Router, load balancing and Cloud Armor, Cloud DNS, Cloud VPN and Interconnect, Cloud CDN backend buckets and Certificate Manager |
| Compute | Compute Engine instances and groups, GKE, Cloud Functions, Cloud Run, App Engine, Dataproc, Composer, Dataflow, Cloud Build triggers, Cloud Scheduler jobs and Artifact Registry |
| Storage and data | Cloud Storage, Cloud SQL, Spanner, Bigtable, Firestore, BigQuery, Memorystore, Filestore, Pub/Sub, disks, snapshots and images, Cloud KMS and Secret Manager |
| Logging and detection | Logging sinks and metrics, monitoring alert policies, the Security Command Center and Sensitive Data Protection signals, and the Access Approval settings |
| Governance | The effective organization policy of the CIS constraints |
| AI services | Vertex AI Workbench and endpoints |
Exposure
The path from the internet is resolved through the external address, the VPC network and the firewall rules that admit the internet to the network tags or the service account of the instance, the authorized networks of a Cloud SQL instance or a GKE control plane, the IAM bindings of a bucket, and the ingress and the invoker of a Cloud Run service or a function.
Identity profile
A service account gets the roles it holds on the project, Owner or Editor and the token creator or service account user roles as escalation paths, the members of other projects that may impersonate it as external trust, and its user-managed keys with their age.
Real-time changes
An administrative change reaches WASViking within a minute from Cloud Audit Logs, through a subscription in your project.
Azure
Resources
| Area | Resources |
|---|---|
| Identity | The subscription and its resource groups, role assignments and custom roles, managed identities, and with the directory consent the Entra ID users, groups, service principals and applications |
| Network | Virtual networks, network security groups, interfaces and public addresses, load balancers and application gateways, Azure Firewall, Bastion, VPN gateways, private endpoints, route tables and NAT gateways, Network Watcher and flow logs, and DNS zones |
| Compute | Virtual machines and scale sets, AKS, Container Registry and App Service |
| Storage and data | Storage accounts, managed disks, snapshots and images, key vaults, Azure SQL, the PostgreSQL and MySQL flexible servers, Cosmos DB, Azure Cache for Redis, Event Hubs and Service Bus |
| Logging and detection | The Activity Log export and alerts, Log Analytics, and the Microsoft Defender for Cloud and Azure Policy signals |
| AI services | Azure AI services and Azure Machine Learning |
Exposure
The path from the internet is resolved through the public address, the network security groups of the subnet and of the interface (both must admit a port), the load balancers and application gateways in front, the firewall rules of a SQL or flexible server, the anonymous containers of a storage account, the access restrictions and the authentication of an App Service site, and the authorized ranges of an AKS API server.
Identity profile
A person, a group, an application or a managed identity gets its role assignments and their scope; Owner, User Access Administrator, Managed Identity Operator or a custom role that writes role assignments as escalation paths; and an application registered in another tenant as external trust. When the directory consent is granted, the profile also holds the MFA registration, the last sign-in and the age of the secrets of an application.
Real-time changes
Built in: a change is read from the Activity Log of the subscription through the delegation, minutes after Azure records it, with nothing to deploy.