Audit Checklist for Cloud Computing

Standard Operating Procedure: Audit Checklist for Cloud Computing

1. Document Control & Revision History

---

2. Executive Summary & Scope

Purpose: This SOP establishes the rigorous framework for assessing the security, operational integrity, and cost-efficiency of enterprise cloud environments (AWS, Azure, GCP). Scope: This procedure applies to all IaaS, PaaS, and SaaS environments under the organizational umbrella. It encompasses Identity & Access Management (IAM), data encryption-at-rest/in-transit, network segmentation, and disaster recovery (DR) efficacy. Regulatory Compliance: Audit activities are aligned with NIST SP 800-53, SOC2 Type II, and ISO/IEC 27017 standards.

---

3. Prerequisites & Tool Requirements

• Access Privileges: Read-only access to cloud management consoles (IAM Audit role).
• Software/Tools:
  • Cloud Security Posture Management (CSPM) tool (e.g., Wiz, Palo Alto Prisma).
  • Infrastructure-as-Code (IaC) scanners (e.g., Checkov, tfsec).
  • API-based log aggregation tools (e.g., Splunk, Datadog).
• Certifications: Auditor must possess active CISSP, CISA, or CCSP certification.
• Safety/Security: Multi-Factor Authentication (MFA) must be enforced on all audit-linked accounts.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase 1: Identity & Access Management (IAM) Review

• Verify that root/master accounts are protected by hardware MFA.
• Confirm the implementation of Least Privilege; audit all roles with AdministratorAccess or equivalent.
• Audit dormant accounts (90+ days inactive) and execute automated disabling protocol.
• Review service account token lifespans and rotate expired secrets.

Phase 2: Data Security & Encryption

• Validate that all S3 buckets/storage containers have "Block Public Access" enabled.
• Confirm AES-256 (or higher) encryption-at-rest for all persistent volumes.
• Verify TLS 1.2+ usage for all endpoints (no plaintext/HTTP traffic allowed).
• Confirm centralized key management (e.g., AWS KMS) with annual rotation policies.

Phase 3: Infrastructure & Networking

• Inspect VPC/VNet peering configurations for unauthorized inter-zone traffic.
• Validate Security Group rules—deny all 0.0.0.0/0 ingress on management ports (22, 3389).
• Confirm Web Application Firewall (WAF) logs are streaming to a centralized SIEM.

Phase 4: Monitoring & Continuity

• Confirm that CloudTrail/Activity Logs are immutable and archived for 365 days.
• Validate RPO (Recovery Point Objective) and RTO (Recovery Time Objective) benchmarks in Disaster Recovery documentation.

---

6. Quality Assurance & Verification Criteria

---

7. Practical Troubleshooting Scenarios

Scenario A: Unidentified Publicly Accessible Storage

• Symptom: CSPM alert identifies an S3 bucket with public ACLs containing PII/PHI.
• Corrective Action:
  1. Immediately set bucket access to Private via API/CLI.
  2. Check CloudTrail logs for GetBucketPolicy or ListBucket calls originating from non-authorized IPs.
  3. Rotate all API keys associated with the identity that created the bucket.

Scenario B: Security Group Drift (Ingress 0.0.0.0/0)

• Symptom: Terraform drift detected; SSH port 22 opened globally by a developer for temporary troubleshooting.
• Corrective Action:
  1. Initiate auto-remediation script to revert to baseline Security Group state.
  2. Flag incident in Jira; notify the respective owner.
  3. Transition the developer from manual troubleshooting to using a Bastion Host or Systems Manager Session Manager.

Scenario C: Unauthorized Privilege Escalation

• Symptom: Audit log shows an IAM user attached to a PowerUser role without a valid Change Request (CR).
• Corrective Action:
  1. Detach the policy immediately.
  2. Force-reset the user's credentials.
  3. Review all actions taken by that user during the "elevated" window for exfiltration or malicious modifications.