> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-a-cloud-assessment.md).

# Run a Cloud Assessment

Set up and run an AWS, Azure, or Google Cloud assessment.

Cloud assessment uses **Internal Assessment -> Run Assessment**. An agent running on a cloud VM uses that VM's attached IAM role, managed identity, or service account. Do not enter long-lived cloud credentials into Pentest Copilot.

{% hint style="warning" %}
Active cloud tests can read sensitive data or change IAM, workloads, networks, logging, storage, keys, and recovery state. Use only approved identities, categories, scope, and test windows.
{% endhint %}

## Before You Start

Confirm:

* the approved AWS account, Azure subscription/resource group, or GCP project;
* a supported VM with the Pentest Copilot agent and attached workload identity;
* outbound connectivity to Pentest Copilot and provider APIs;
* discovery permissions on the attached identity;
* ownership for temporary permissions, rollback, cleanup, and credential rotation.

{% content-ref url="/pages/ZeohD2bm8TpS8XBNG2W9" %}
[Cloud Assessment Prerequisites](/enterprise/how-to-trigger-a-cloud-assessment/configure-a-cloud-agent.md)
{% endcontent-ref %}

## 1. Set Up the Agent

Install the agent from **Settings -> Agent** on the approved cloud VM. Confirm that it connects and that native instance metadata is reachable from the agent process.

The agent can connect without cloud read access, but provider discovery will be partial or unavailable until the attached identity has the required permissions.

{% content-ref url="/pages/74xr08DgNEibdsc9F6Z2" %}
[Set Up the Cloud Agent](/enterprise/how-to-trigger-a-cloud-assessment/provider-runbooks.md)
{% endcontent-ref %}

## 2. Run Discovery

Open **Modules -> Internal Assessment -> Run Assessment** and choose **Discovery** for an inventory-only run or **Discovery + Assessment** when active testing is already approved.

1. Select the cloud-hosted agent.
2. Select the subnet reported by that agent.
3. In Scan settings, add provider-specific scope only when applicable.
4. Review the workload identity and discovery runtime.
5. Start or schedule the run.

Provider and account scope are detected from the VM identity. AWS resource-name prefixes are optional AWS-only restrictions; they are not required for Azure, GCP, local, or hybrid runs.

When discovery completes, the resulting cloud scope becomes available to Assessment-only runs.

{% content-ref url="/pages/jWUTr1QcyhW2QxWFXCHw" %}
[Discovery Coverage](/enterprise/cloud-assessment-reference/cloud-discovery-coverage.md)
{% endcontent-ref %}

## 3. Configure Active Assessment

Choose **Assessment** to test a previously discovered cloud scope, or continue through a **Discovery + Assessment** run.

1. Select the discovered cloud target and connected cloud agent.
2. Disable every test category that is outside the authorization.
3. Enable retest, regional-monitoring, rollback, or RCE controls only when the engagement requires them.
4. Review temporary provider permissions and stop conditions.

{% content-ref url="/pages/CfF0dPY4Kmmw9SWVKpdT" %}
[Configure the Assessment](/enterprise/how-to-trigger-a-cloud-assessment/configure-cloud-assessment.md)
{% endcontent-ref %}

## 4. Review and Start

Confirm the provider scope, attached identity, agent, categories, rollback choices, runtime, and schedule. Then choose **Start run** or **Schedule run**.

Monitor progress under **Activity -> Activity**. Completed findings appear under **Internal Assessment -> Attack Paths** and in the Exploit Graph.

## 5. Finish Safely

After the run:

1. Confirm assessment and supported rollback work has stopped.
2. Remove temporary active permissions.
3. Complete required manual cleanup and credential rotation.
4. Preserve provider audit evidence.
5. Review findings and generate reports.

{% content-ref url="/pages/9hB3HBinyL74mFNggXKn" %}
[Safety and Cleanup](/enterprise/cloud-assessment-reference/cloud-assessment-safety-and-cleanup.md)
{% endcontent-ref %}

For provider permissions and inventory details, see [Cloud Assessment Reference](/enterprise/cloud-assessment-reference.md).