> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/cloud-scan.md).

# Cloud scan

The Cloud scan monitors and analyzes the part of your infrastructure located in the cloud. It does not include storage solutions such as OneDrive, SharePoint, or Google Drive.

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h4><i class="fa-microsoft">:microsoft:</i></h4></td><td><h4>Setup: Azure Cloud</h4></td><td>Assign the reader roles on your Azure subscription.</td><td><a href="/prevention-tools/cloud-scan/azure.md">Setup: Azure Cloud</a></td></tr><tr><td><h4><i class="fa-microsoft">:microsoft:</i></h4></td><td><h4>Setup: Entra ID</h4></td><td>Grant the reader roles for a Microsoft 365 tenant.</td><td><a href="/prevention-tools/cloud-scan/entra-id.md">Setup: Entra ID</a></td></tr><tr><td><h4><i class="fa-aws">:aws:</i></h4></td><td><h4>Setup: AWS</h4></td><td>Create the read-only policy and role for your AWS account.</td><td><a href="/prevention-tools/cloud-scan/aws.md">Setup: AWS</a></td></tr><tr><td><h4><i class="fa-google">:google:</i></h4></td><td><h4>Setup: GCP</h4></td><td>Create the service account for your Google Cloud project.</td><td><a href="/prevention-tools/cloud-scan/gcp.md">Setup: GCP</a></td></tr><tr><td><h4><i class="fa-chart-line">:chart-line:</i></h4></td><td><h4>Reading results</h4></td><td>Understand your score and each detected misconfiguration.</td><td><a href="/prevention-tools/cloud-scan/results.md">Reading results</a></td></tr><tr><td><h4><i class="fa-user-shield">:user-shield:</i></h4></td><td><h4>MFA status</h4></td><td>Check which employees have enabled MFA in Azure.</td><td><a href="/prevention-tools/cloud-scan/azure/mfa-status.md">MFA status</a></td></tr></tbody></table>

## How it works

The Cloud scan uses the open-source tool ScoutSuite, and is available for the leading cloud providers: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). It analyzes elements of your cloud configuration deemed critical from a cybersecurity perspective:

* **User access methods and rights:** verify that user rights and authentication methods are properly hardened.
* **Password policy:** audit the password policy and ensure it is not overly permissive.
* **Database exposure:** validate that databases are not publicly exposed on the internet and analyze access rights.
* **Firewall rules:** audit access rules to the cloud infrastructure.
* **Backup policy:** verify that backups are performed regularly.

{% hint style="info" %}
Stoïk Protect only has read access to the cloud infrastructure configuration, enabling technical auditing. It does not access data stored in the cloud (company data, emails) and cannot modify the infrastructure.
{% endhint %}

## Scan frequency

The scan runs about every 24 hours, counted from when you finished the setup, without any action required from you. To refresh the results right away, restart the scan from `Cloud Scan` > `Settings`.

## Entra ID

The Cloud scan analyzes Active Directories located in the cloud (also known as Entra IDs). When only Office 365 via Entra ID is scanned, the analysis focuses on aspects related to your mailbox, such as detecting users who have not enabled two-factor authentication.

If you only have Microsoft 365, with no Azure servers, use the [Entra ID](/prevention-tools/cloud-scan/entra-id.md) provider. In `Cloud Scan` > `Settings`, Entra ID-only providers are displayed under the Azure logo.

## Several accounts, projects or subscriptions

Each AWS account, GCP project or Azure subscription is set up separately, from `Cloud Scan` > `Settings` > `New Provider`. There is no organization-wide setup and no API to automate it.

A tenant or cloud account can only belong to one Stoïk Protect company. If you get "This tenant / account is already linked to another company", or if you added the wrong tenant or the same tenant twice, contact <protect@stoik.io> with the tenant or account ID. Do not add the same tenant again on top.

## What is not covered

* Google Workspace (Gmail, Drive, Calendar): the Cloud scan covers Google Cloud Platform only.
* Azure DevOps, and SaaS tools hosted by a vendor.
* Entra ID app registrations, service principals and OAuth apps.
* A full review of Conditional Access policies: they are only read for the MFA findings.
* Other clouds, such as Scaleway, OVH, Orange or Magenta Cloud.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/prevention-tools/cloud-scan.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.