Cloud Infrastructure Audit Checklist

Standard Operating Procedure: Cloud Infrastructure Audit Checklist

Document Identifier: SOP-OPS-INF-8842
Classification: Internal Operational Standard / Regulatory Compliance

---

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) defines the mandatory, repeatable framework for executing comprehensive infrastructure audits across all enterprise cloud environments (AWS, Azure, Google Cloud Platform). The operational boundaries encompass compute instances, storage buckets, identity and access management (IAM) policies, networking topologies, container orchestration planes, and telemetry logging configurations. Adherence to this SOP ensures continuous posture management, minimizes attack surfaces, and verifies compliance with regulatory mandates.

2.2 Regulatory Standards & Compliance Frameworks

Executions performed under this SOP must satisfy or exceed the structural requirements of the following frameworks:

• SOC 2 Type II: Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality).
• ISO/IEC 27001:2022: Information Security Management Systems controls.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations.
• PCI-DSS v4.0: Cardholder Data Environment (CDE) cloud segmentation and encryption requirements.
• GDPR / CCPA: Data residency, encryption-at-rest, and cryptographic erasure protocols.

---

3. Prerequisites & Tool Requirements

3.1 Software Access & Authorization

• Privileged Access: Read-only enterprise auditor roles (e.g., AWS SecurityAudit, Azure Reader, GCP Viewer) across all target accounts, subscriptions, and projects.
• API/CLI Tooling:
  • Terraform v1.6+ (for infrastructure-as-code state drift analysis).
  • Cloud Provider CLI suites (AWS CLI v2, Azure CLI, gcloud SDK) configured with multi-factor authentication (MFA).
  • Security Posture Management (CSPM) tooling API access (e.g., Prisma Cloud, Wiz, Datadog Security).
• Scripting Environment: Python 3.10+ execution environment with boto3, azure-mgmt, and google-cloud dependencies installed for custom validation scripts.

3.2 Safety PPE & Operational Safeguards

• Dry-Run Enforcements: All scripts and API queries must be executed in --dry-run or read-only modes to prevent state mutations.
• Change Management Window: Live infrastructural probes that may induce API throttling must be scheduled within approved change windows.

---

4. Roles & Responsibilities (RACI Matrix Table)

---

5. Step-by-Step Operational Procedure

Phase 1: Identity and Access Management (IAM) Verification

• 1.1 Verify that root/master accounts across all cloud providers have Multi-Factor Authentication (MFA) enforced via hardware tokens.
• 1.2 Audit all IAM policies for overly permissive statements (Action: "*", Resource: "*") and document any violations.
• 1.3 Identify human users with active access keys older than 90 days and verify rotation schedules.
• 1.4 Validate that service accounts and IAM roles adhere to the principle of least privilege using automated permission-analyzer reports.
• 1.5 Confirm that cross-account trust relationships are explicitly scoped with external ID requirements.

Phase 2: Network Topology & Perimeter Defense Audit

• 2.1 Inspect all Virtual Private Clouds (VPCs) / Virtual Networks (VNets) to ensure public subnets are strictly isolated from internal data tiers.
• 2.2 Review Security Groups and Network Security Groups (NSGs) for unrestricted inbound access on administrative ports (SSH/22, RDP/3389, Database ports).
• 2.3 Verify that flow logs (VPC Flow Logs, Network Watcher) are enabled, centralized, and streamed to an immutable storage tier.
• 2.4 Validate Load Balancer configurations, ensuring TLS 1.3 is enforced and deprecated ciphers (SSLv3, TLS 1.0, TLS 1.1) are disabled.
• 2.5 Confirm Web Application Firewall (WAF) rule sets are actively inspecting traffic on all public-facing HTTP/HTTPS endpoints.

Phase 3: Data Protection, Storage, & Encryption Review

• 3.1 Audit object storage buckets (S3, Azure Blob, GCS) to ensure public access blocks are globally enabled at the organizational level.
• 3.2 Verify that all data-at-rest (block storage, object storage, databases) is encrypted using Customer-Managed Keys (CMK) via Key Management Services (KMS / Key Vault).
• 3.3 Check database instances (RDS, Azure SQL, Cloud SQL) to ensure public IP assignments are disabled and TLS connections are mandatory.
• 3.4 Review backup retention policies, immutable vault configurations, and cross-region replication status for disaster recovery readiness.
• 3.5 Execute a test metadata inspection for unencrypted temporary volumes (ephemeral disks) attached to compute nodes.

Phase 4: Logging, Monitoring, & Incident Response Readiness

• 4.1 Confirm centralized audit logging (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) is aggregating to a write-once-read-many (WORM) storage bucket.
• 4.2 Verify that SIEM integration (e.g., Splunk, Datadog, Microsoft Sentinel) is receiving real-time security events without pipeline lag.
• 4.3 Inspect alerting thresholds for critical security events (e.g., root login, unauthorized IAM changes, security group modifications).
• 4.4 Validate that automated incident response runbooks (SOAR integrations) are active and verified via quarterly dry-runs.

---

6. Quality Assurance & Verification Criteria

6.1 Audit Checklist Acceptance Benchmarks

To achieve a passing audit status, the target cloud environment must meet the following quantitative and qualitative thresholds:

6.2 Remediation SLA Timelines

• Critical Severity (e.g., Public S3 bucket containing PII, root key exposed): Remediation required within 2 hours.
• High Severity (e.g., Overly permissive IAM role, missing encryption on non-production database): Remediation required within 24 hours.
• Medium/Low Severity (e.g., Tagging inconsistencies, old access keys): Remediation required within 14 business days.

---

7. Practical Troubleshooting Scenarios

Scenario A: API Throttling / Rate Limiting During Automated Scans

• Symptom: Audit scripts fail mid-execution with HTTP 429 Too Many Requests or RequestLimitExceeded errors from cloud provider APIs.
• Immediate Corrective Action Protocol:
  1. Immediately abort the high-concurrency audit script to prevent account-wide service degradation.
  2. Implement exponential backoff and jitter algorithms within the custom API calling libraries.
  3. Throttle thread/worker counts in CSPM tools to respect provider service quotas (e.g., limit AWS Describe* calls to 5 requests per second).
  4. Resume execution outside peak operational hours or request temporary service quota increases via cloud support channels.

Scenario B: Unresponsive or Locked Centralized Logging Pipeline

• Symptom: SIEM integration indicates log ingestion lag exceeding 4 hours; CloudTrail/Activity logs failing to export to the archival bucket.
• Immediate Corrective Action Protocol:
  1. Check the storage bucket access control lists (ACLs) and bucket policies to ensure the logging service principal holds explicit PutObject permissions.
  2. Verify KMS key policies; ensure the cloud logging service principal has Decrypt and GenerateDataKey grants on the customer-managed encryption key.
  3. If KMS key rotation broke the grant, manually re-apply the key policy policy statement for the logging service.
  4. Manually trigger a test log event and verify delivery confirmation via the respective cloud provider's delivery status telemetry.