Run a Cloud Assessment

Set up and run an AWS, Azure, or Google Cloud assessment.

Cloud assessment uses Internal Assessment -> Run Assessment. An agent running on a cloud VM uses that VM's attached IAM role, managed identity, or service account. Do not enter long-lived cloud credentials into Pentest Copilot.

Active cloud tests can read sensitive data or change IAM, workloads, networks, logging, storage, keys, and recovery state. Use only approved identities, categories, scope, and test windows.

Before You Start

Confirm:

• the approved AWS account, Azure subscription/resource group, or GCP project;

• a supported VM with the Pentest Copilot agent and attached workload identity;

• outbound connectivity to Pentest Copilot and provider APIs;

• discovery permissions on the attached identity;

• ownership for temporary permissions, rollback, cleanup, and credential rotation.

Cloud Assessment Prerequisites

1. Set Up the Agent

Install the agent from Settings -> Agent on the approved cloud VM. Confirm that it connects and that native instance metadata is reachable from the agent process.

The agent can connect without cloud read access, but provider discovery will be partial or unavailable until the attached identity has the required permissions.

Set Up the Cloud Agent

2. Run Discovery

Open Modules -> Internal Assessment -> Run Assessment and choose Discovery for an inventory-only run or Discovery + Assessment when active testing is already approved.

1. Select the cloud-hosted agent.

2. Select the subnet reported by that agent.

3. In Scan settings, add provider-specific scope only when applicable.

4. Review the workload identity and discovery runtime.

5. Start or schedule the run.

Provider and account scope are detected from the VM identity. AWS resource-name prefixes are optional AWS-only restrictions; they are not required for Azure, GCP, local, or hybrid runs.

When discovery completes, the resulting cloud scope becomes available to Assessment-only runs.

Discovery Coverage

3. Configure Active Assessment

Choose Assessment to test a previously discovered cloud scope, or continue through a Discovery + Assessment run.

1. Select the discovered cloud target and connected cloud agent.

2. Disable every test category that is outside the authorization.

3. Enable retest, regional-monitoring, rollback, or RCE controls only when the engagement requires them.

4. Review temporary provider permissions and stop conditions.

Configure the Assessment

4. Review and Start

Confirm the provider scope, attached identity, agent, categories, rollback choices, runtime, and schedule. Then choose Start run or Schedule run.

Monitor progress under Activity -> Activity. Completed findings appear under Internal Assessment -> Attack Paths and in the Exploit Graph.

5. Finish Safely

After the run:

1. Confirm assessment and supported rollback work has stopped.

2. Remove temporary active permissions.

3. Complete required manual cleanup and credential rotation.

4. Preserve provider audit evidence.

5. Review findings and generate reports.

Safety and Cleanup

For provider permissions and inventory details, see Cloud Assessment Reference.