Cloud Assessment Prerequisites

Confirm the cloud scope, VM, identity, network access, and operational ownership required for an assessment.

Approved Scope

Before deployment, confirm:

• the AWS account, Azure subscription and resource group, or Google Cloud project;

• the assessment window and permitted test categories;

• excluded resources or operations;

• the owner who can stop the assessment;

• the owner of provider permissions and cleanup.

Supported Agent Host

The agent must run on provider compute and use the identity attached to that VM.

Provider	Agent host	Attached identity	Discovery boundary
AWS	EC2 instance	IAM role through an instance profile	Detected account, VM region, and configured resource-name prefixes
Azure	Azure VM	System-assigned or user-assigned managed identity	Detected subscription and VM resource group
Google Cloud	Compute Engine VM	Service account	Detected project

Static access keys, local CLI profiles, service-account key files, and redirected metadata endpoints are not used.

VM Requirements

Use an existing Windows or Linux VM or provision one that meets the requirements in Download Agent. An existing VM is supported when its operational use allows the agent to run during the assessment. Confirm that:

• the VM is inside the approved cloud boundary;

• native instance metadata is reachable;

• outbound HTTPS reaches Pentest Copilot and required provider APIs;

• the host clock is synchronized;

• endpoint protection allows the documented agent files and processes.

Cloud discovery and active cloud tests do not require a browser or interactive desktop session.

Permission Plan

The agent can install and connect without provider read or administrator access.

For cloud assessment, plan:

1. Discovery permissions for cloud inventory and configuration reads.

2. Active permissions for the selected test categories and supported rollback.

Apply discovery permissions before running cloud discovery. Apply temporary active permissions only after the test categories are approved.

Ready to Continue

Continue when the cloud boundary, VM, identity, network access, permission owner, and cleanup owner are confirmed.

Set Up the Cloud Agent