Cloud security and IAM cheat sheet

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::reports-prod/summaries/*"
  }]
}

aws sts get-caller-identity
aws iam list-attached-role-policies --role-name build
aws iam simulate-principal-policy --policy-source-arn ARN --action-names s3:PutObject --resource-arns ARN
aws iam generate-service-last-accessed-details --arn ARN

az account show
az role assignment list --assignee USER --all -o table
az role assignment create --assignee USER --role "Reader" --scope /subscriptions/SUB/resourceGroups/RG
az identity create --name app-identity --resource-group RG

aws secretsmanager get-secret-value --secret-id prod/db --query SecretString --output text
aws kms describe-key --key-id alias/app-data
az keyvault secret show --vault-name kv-prod --name db-password --query value -o tsv

aws s3api get-public-access-block --bucket NAME
aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0
az network nsg rule list --nsg-name NSG --resource-group RG -o table

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteTrail --max-results 5
aws cloudtrail get-trail-status --name org-trail
az monitor activity-log list --offset 1d -o table

1. Contain  - deactivate the key or revoke the session (do not delete yet)
2. Assess   - audit log: what did this credential do, from where
3. Remove   - attacker-created users, keys, servers, policies
4. Rotate   - related secrets; replace with a role
5. Learn    - how it leaked; add detection