Cloud Assessment Prerequisites
Confirm the cloud scope, VM, identity, network access, and operational ownership required for an assessment.
Approved Scope
Before deployment, confirm:
the AWS account, Azure subscription and resource group, or Google Cloud project;
the assessment window and permitted test categories;
excluded resources or operations;
the owner who can stop the assessment;
the owner of provider permissions and cleanup.
Supported Agent Host
The agent must run on provider compute and use the identity attached to that VM.
AWS
EC2 instance
IAM role through an instance profile
Detected account, VM region, and configured resource-name prefixes
Azure
Azure VM
System-assigned or user-assigned managed identity
Detected subscription and VM resource group
Google Cloud
Compute Engine VM
Service account
Detected project
Static access keys, local CLI profiles, service-account key files, and redirected metadata endpoints are not used.
VM Requirements
Use an existing Windows or Linux VM or provision one that meets the requirements in Download Agent. An existing VM is supported when its operational use allows the agent to run during the assessment. Confirm that:
the VM is inside the approved cloud boundary;
native instance metadata is reachable;
outbound HTTPS reaches Pentest Copilot and required provider APIs;
the host clock is synchronized;
endpoint protection allows the documented agent files and processes.
Cloud discovery and active cloud tests do not require a browser or interactive desktop session.
Permission Plan
The agent can install and connect without provider read or administrator access.
For cloud assessment, plan:
Discovery permissions for cloud inventory and configuration reads.
Active permissions for the selected test categories and supported rollback.
Apply discovery permissions before running cloud discovery. Apply temporary active permissions only after the test categories are approved.
Ready to Continue
Continue when the cloud boundary, VM, identity, network access, permission owner, and cleanup owner are confirmed.
Set Up the Cloud AgentLast updated