Cloud Scan
The Cloud Scan analyzes your cloud environment (Microsoft Azure / Entra ID / Microsoft 365, AWS, or Google Cloud) and flags misconfigurations that could be exploited by attackers. Unlike vulnerabilities in software that need patching, most cloud findings are configuration issues that can be fixed directly from your cloud provider's admin console.
Each finding includes:
What it means: a plain-language explanation of the risk
What the scan checks: the specific condition that triggers the alert
How to fix: step-by-step instructions
Remediation steps are grouped by cloud provider:
Frequently Asked Questions
How often does the Cloud Scan run?
The Cloud Scan runs automatically on a regular basis. After applying a fix, allow up to 24 hours for the next scan to pick up the changes. You can also trigger a rescan from the Stoïk Protect portal.
I fixed the finding but it's still showing. Why?
The most common reasons:
The scan hasn't re-run yet: wait for the next scan cycle.
The fix was applied to the wrong resource: check that you modified the correct subscription, resource group, or project.
There are multiple instances: the same issue may exist on multiple resources (e.g., several storage accounts with public access).
Do I need Global Admin rights to fix these issues?
Most Azure findings require at least Security Administrator or Contributor role on the relevant subscription. Entra ID findings (MFA, Shadow Admin) require Global Administrator or Privileged Role Administrator.
For AWS, you need IAM permissions to modify the relevant services. For GCP, you need the appropriate IAM roles.
Can findings be dismissed?
If a finding is an accepted risk or a false positive (e.g., a storage bucket that is intentionally public for a static website), contact Stoïk support to document it as an exception.
Last updated
Was this helpful?