> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/cloud-assessment-reference/cloud-assessment-safety-and-cleanup.md).

# Safety and Cleanup

Define stop conditions, understand rollback limits, and verify cloud cleanup after active testing.

Cloud discovery reads supported inventory and configuration. Active assessment can read data, use credentials, execute workloads, or change provider state according to the selected categories and attached identity permissions.

## Before Active Testing

Confirm:

* written authorization covers the selected cloud scope and test window;
* discovery completed or every accepted coverage limit is documented;
* every enabled test category is approved;
* temporary active permissions match those categories;
* test data and assessment-owned resources are available where destructive proof is allowed;
* provider audit logs and production alerts are monitored;
* one operator can cancel the run;
* one operator owns manual cleanup if rollback is unavailable or fails;
* credential rotation and incident-response contacts are ready.

Use [Configure the Assessment](/enterprise/how-to-trigger-a-cloud-assessment/configure-cloud-assessment.md) to review what each cloud category tests.

## Stop Conditions

Stop new assessment work and begin verification when:

* the agent reports a different provider scope or identity;
* the run touches a resource outside written authorization;
* a provider audit event cannot be matched to an expected test;
* a production alert, outage, quota event, or workload failure occurs;
* the agent disconnects during a state-changing operation;
* rollback cannot read or restore its recorded baseline;
* another operator changes the same resource during the test.

Cancelling the assessment stops remaining scheduled work. It does not reverse provider operations that already completed.

## Rollback Limits

Rollback is disabled by default. When enabled, supported tests record restoration data and queue cleanup after normal assessment work finishes.

Rollback can remain incomplete when:

* the provider does not support the required restoration;
* the resource changed after its baseline was captured;
* the attached identity lost permission before cleanup;
* the resource was deleted or became unavailable;
* a test failed before it recorded enough state;
* the action requires credential rotation or external recovery.

Rollback is not a provider-wide transaction. Verify provider state directly even when Pentest Copilot reports successful rollback.

## Cleanup Checklist

After the assessment:

1. Confirm assessment and rollback work reached a final state.
2. Review provider audit logs for every identity and resource change.
3. Compare identity, policy, network, logging, key, workload, recovery, and storage configuration with the approved baseline.
4. Remove assessment-created resources, scripts, keys, grants, sessions, links, messages, and temporary data.
5. Remove temporary provider permissions.
6. Rotate credentials, tokens, signed URLs, certificates, and trust material exposed during testing.
7. Confirm modified or deleted recovery resources remain recoverable.
8. Record manual cleanup and independent verification.
9. Generate reports after findings and cleanup status are reviewed.

Provider-specific review should include:

* **AWS:** CloudTrail events, IAM changes, network controls, objects, keys, queues, scripts, and workload changes.
* **Azure:** Activity Log and Entra audit events, RBAC and directory assignments, Key Vault and Storage access, network changes, extensions, applications, and workload settings.
* **Google Cloud:** Cloud Audit Logs, IAM bindings, service-account keys, storage objects, images, builds, functions, services, triggers, firewall rules, logging sinks, and recovery artifacts.

## Cleanup Evidence

Keep enough evidence to prove restoration without retaining exposed secrets:

* assessment and check references;
* provider audit event IDs and timestamps;
* affected resource IDs;
* baseline and restored configuration hashes or sanitized exports;
* rollback status and manual cleanup owner;
* credential rotation ticket or confirmation;
* final verification time and reviewer.

Do not store access tokens, private keys, secret values, signed URLs, session cookies, or full credential files in assessment notes.

{% content-ref url="/pages/yIa5DS9u5uSEnjRhi5DZ" %}
[Analysing Scan Results](/enterprise/analysing-scan-results.md)
{% endcontent-ref %}