Skip to main content
AQIRA
Book a demo
AQIRA

Menu

Book a demo

Solutions / Cloud accounts

Cloud security posture for AWS, Azure and GCP, scored against CIS Benchmarks

With a read-only role, AQIRA inventories the account, reads identity, logging, storage and network configuration, and validates internet exposure with benign proof. Nothing is changed.

Book a demoHow an assessment runs
You provide
AWS, Azure or GCP
Intensity
Standard
Scored against
CIS AWS, CIS Azure, CIS GCP
Plans
On Premium, with 2 accounts (up to 5 with add-ons), and Enterprise, with 5. Compare the plans
AQIRA consoleNew assessmentProduct UI, demo data
AQIRA's New assessment dialog with Cloud account and AWS selected: the account ID, the role ARN, the trust policy and the read-only role policy.AQIRA's New assessment dialog with Cloud account and AWS selected: the account ID, the role ARN, the trust policy and the read-only role policy.
The New assessment step for an AWS account: account ID, role ARN, trust policy and read-only policy.View full size: the New assessment screenView full size: the New assessment screen

What you hand AQIRA

On a cloud account, the New assessment step asks for the following.

You provide
A read-only role in AWS, or read-only access in Azure or GCP.
Access
AQIRA's trust policy and read-only policies are attached in your own console. AQIRA never asks for write access.
Authorisation
The assessment starts only once the operator confirms: I authorize a read-only audit of this account.
Intensity
  • Standard. Active testing with safe, non-destructive proofs of concept.

What each input's access allows, and how AQIRA keeps it to the least it needs, is on the security page.

ORION, VEGA, ATLAS, NOVA, POLARIS, SCRIBE

What each agent does on this input

The same six agents, in the same order; on a cloud account this is the work.

  1. 01ORIONConnect and inventory

    Assumes the read-only role and inventories the account.

    • Cloud posture
    • Identity inventory
    • Open-source intel

  2. 02VEGAIdentity and access

    Reads identity, access and policy posture.

    • Identity posture
    • Policy readout
    • Vulnerability correlation

  3. 03ATLASLogging, storage and network

    Reviews logging, storage and network configuration.

    • Cloud posture
    • Logging review
    • Dependency risk

  4. 04NOVAPublic exposure validation

    Validates public exposure of resources to benign proof.

    • Remote-asset exposure
    • Hidden-data inspection
    • Vulnerability correlation

  5. 05POLARISCIS scoring

    Consolidates what the others found. Scores the account against the CIS benchmark for its provider.

  6. 06SCRIBEReport

    Writes the client-deliverable report from the same evidence the console shows.

AQIRA consoleLive consoleProduct UI, demo data
The AQIRA live console for a read-only assessment of a production AWS account: provider, account, audit role, region and CIS result, then the five phases from inventory to CIS scoring.The AQIRA live console for a read-only assessment of a production AWS account: provider, account, audit role, region and CIS result, then the five phases from inventory to CIS scoring.
The account, the audit role and the CIS result, then the five phases for a cloud account.View full size: the Live console screenView full size: the Live console screen

The findings it raises

Examples of what AQIRA reports on a cloud account, each with evidence, steps to reproduce, remediation in priority order and its ATT&CK technique.

AWS

  • Root account without multi-factor authentication
  • Security group that allows SSH from any address
  • S3 bucket that allows public read
  • CloudTrail not multi-region

Azure

  • Privileged Entra user without MFA
  • Blob container with public access
  • Network security group that allows RDP from the internet
  • Key Vault purge protection disabled

GCP

  • Service account with a project-level admin role
  • Bucket accessible to allUsers
  • Cloud SQL instance that accepts connections from any address
  • Data Access audit logs not configured

Examples only. What an assessment finds depends on your target; the capture shows a demo assessment.

AQIRA consoleFindingsProduct UI, demo data
The findings table of an AQIRA assessment of a production AWS account: ten findings from a root account without multi-factor authentication to KMS key rotation disabled, with the affected resource and ATT&CK technique.The findings table of an AQIRA assessment of a production AWS account: ten findings from a root account without multi-factor authentication to KMS key rotation disabled, with the affected resource and ATT&CK technique.
The assessment's findings, each with its resource and ATT&CK technique; new findings since the last assessment are marked.View full size: the Findings screenView full size: the Findings screen

What it maps, and where results land

Cloud results also land in the Cloud module, one screen per account: risk, public resources, findings by service and CIS Benchmark coverage.

Cloud resources
Accounts, subscriptions and projects, IAM users and roles, storage, compute, databases, network rules, keys and audit trails.
Identities and roles
Who and what can act in the account, and with which roles.
Policies and settings
The account's policies and configuration, read as they are set.
AQIRA consoleCloudProduct UI, demo data
The AQIRA Cloud module for a production AWS account: risk, public resources and misconfiguration findings by service, with CIS coverage.The AQIRA Cloud module for a production AWS account: risk, public resources and misconfiguration findings by service, with CIS coverage.
Risk, public resources and findings by service, one screen per account.View full size: the Cloud screenView full size: the Cloud screen

Mapped to what your auditors read

POLARIS maps every finding to the controls it touches, in every framework that applies.

Scored against

  • CIS AWS
  • CIS Azure
  • CIS GCP

Every finding is also mapped to

ATT&CK, OWASP, NIST CSF, NIST SP 800-53, NIST SP 800-171 and COBIT.

Control status, owner and evidence are in compliance mapping; what reaches the client is in the reports.

Where this assessment stops

A clean result covers only what AQIRA tests on a cloud account.

  1. Read-only, always

    A read-only role or read-only access, granted in your own console. AQIRA never gains write access.

  2. Posture, not the applications inside

    A cloud assessment reads the account's configuration; web apps and APIs running in it are assessed through their domain.

  3. One intensity

    Cloud assessments run at Standard: reading configuration and checking exposure, never changing anything.

Limits common to every input, and how proof stays benign, are in the methodology.

The other five inputs

Next step

A demo assessment of a cloud account

A demo runs one assessment in the console, with demo data: the agents at work, the evidence behind each finding, and the report.

Book a demoExplore the platform