> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/cyber-best-practices/vulnerability-remediation-guides/cloud-scan.md). # Cloud Scan The Cloud Scan analyzes your cloud environment (Microsoft Azure / Entra ID / Microsoft 365, AWS, or Google Cloud) and flags misconfigurations that could be exploited by attackers. Unlike vulnerabilities in software that need patching, most cloud findings are **configuration issues** that can be fixed directly from your cloud provider's admin console. Each finding includes: * **What it means:** a plain-language explanation of the risk * **What the scan checks:** the specific condition that triggers the alert * **How to fix:** step-by-step instructions Remediation steps are grouped by cloud provider: * [Microsoft Azure / Entra ID / Microsoft 365](/cyber-best-practices/vulnerability-remediation-guides/cloud-scan/microsoft-azure-entra-id-microsoft-365.md) * [Amazon Web Services (AWS)](/cyber-best-practices/vulnerability-remediation-guides/cloud-scan/amazon-web-services-aws.md) * [Google Cloud Platform (GCP)](/cyber-best-practices/vulnerability-remediation-guides/cloud-scan/google-cloud-platform-gcp.md) ## Frequently Asked Questions #### How often does the Cloud Scan run? The Cloud Scan runs automatically on a regular basis. After applying a fix, allow up to 24 hours for the next scan to pick up the changes. You can also trigger a rescan from the Stoïk Protect portal. #### I fixed the finding but it's still showing. Why? The most common reasons: * **The scan hasn't re-run yet:** wait for the next scan cycle. * **The fix was applied to the wrong resource:** check that you modified the correct subscription, resource group, or project. * **There are multiple instances:** the same issue may exist on multiple resources (e.g., several storage accounts with public access). #### Do I need Global Admin rights to fix these issues? Most Azure findings require at least **Security Administrator** or **Contributor** role on the relevant subscription. Entra ID findings (MFA, Shadow Admin) require **Global Administrator** or **Privileged Role Administrator**. For AWS, you need IAM permissions to modify the relevant services. For GCP, you need the appropriate IAM roles. #### Can findings be dismissed? If a finding is an accepted risk or a false positive (e.g., a storage bucket that is intentionally public for a static website), contact Stoïk support to document it as an exception. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/cyber-best-practices/vulnerability-remediation-guides/cloud-scan.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.