> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-a-cloud-assessment/configure-a-cloud-agent.md).

# Cloud Assessment Prerequisites

Confirm the cloud scope, VM, identity, network access, and operational ownership required for an assessment.

## Approved Scope

Before deployment, confirm:

* the AWS account, Azure subscription and resource group, or Google Cloud project;
* the assessment window and permitted test categories;
* excluded resources or operations;
* the owner who can stop the assessment;
* the owner of provider permissions and cleanup.

## Supported Agent Host

The agent must run on provider compute and use the identity attached to that VM.

| Provider     | Agent host        | Attached identity                                 | Discovery boundary                                                 |
| ------------ | ----------------- | ------------------------------------------------- | ------------------------------------------------------------------ |
| AWS          | EC2 instance      | IAM role through an instance profile              | Detected account, VM region, and configured resource-name prefixes |
| Azure        | Azure VM          | System-assigned or user-assigned managed identity | Detected subscription and VM resource group                        |
| Google Cloud | Compute Engine VM | Service account                                   | Detected project                                                   |

Static access keys, local CLI profiles, service-account key files, and redirected metadata endpoints are not used.

## VM Requirements

Use an existing Windows or Linux VM or provision one that meets the requirements in [Download Agent](/enterprise/download-agent.md). An existing VM is supported when its operational use allows the agent to run during the assessment. Confirm that:

* the VM is inside the approved cloud boundary;
* native instance metadata is reachable;
* outbound HTTPS reaches Pentest Copilot and required provider APIs;
* the host clock is synchronized;
* endpoint protection allows the documented agent files and processes.

Cloud discovery and active cloud tests do not require a browser or interactive desktop session.

## Permission Plan

The agent can install and connect without provider read or administrator access.

For cloud assessment, plan:

1. **Discovery permissions** for cloud inventory and configuration reads.
2. **Active permissions** for the selected test categories and supported rollback.

Apply discovery permissions before running cloud discovery. Apply temporary active permissions only after the test categories are approved.

## Ready to Continue

Continue when the cloud boundary, VM, identity, network access, permission owner, and cleanup owner are confirmed.

{% content-ref url="/pages/74xr08DgNEibdsc9F6Z2" %}
[Set Up the Cloud Agent](/enterprise/how-to-trigger-a-cloud-assessment/provider-runbooks.md)
{% endcontent-ref %}