Cloud security
Nine providers. One workflow engine.
Skydra's cloud coverage is written against the actual provider APIs, not vendored CSPM lists. Each check runs as an action in the same workflow engine the rest of the product uses, with the same safety controls, the same evidence standards, and the same observable execution.
Primary providers
AWS, Azure, GCP — audited, probed, and tracked.
The three where Skydra ships the deepest coverage. Each has a dedicated action for inside-account audits, a URL-pattern probe for public resources, and provider-specific detectors for the common misconfigurations attackers actually exploit.
AWS
IAM paths, S3 ACLs and policies, Lambda invocation URLs, API Gateway exposure, Secrets Manager rotation, CloudTrail hygiene, EC2 metadata exposure, SNS/SQS/EventBridge, Secrets Manager, SSM, DynamoDB, ECR, RDS public access.
Learn moreAzure
Entra ID posture, blob and dfs storage access, Key Vault leaks, Function app sources, Logic App callback URLs, APIM invocation, Cosmos keys, Static Web App URLs, Automation webhooks, SCM endpoints, Service Bus, Container Registry.
Learn moreGoogle Cloud
IAM bindings and service account impersonation, GCS buckets, Cloud Run invokers, App Engine admin APIs, Firebase RTDB and storage, Firestore anonymous writes, Artifact Registry, Container Registry, Datastore, Cloud SQL public access, Cloud Functions.
Learn moreAdditional providers
Six more clouds, treated as first-class.
Attackers do not care which provider a target happens to run on. Every URL pattern parser and provider-specific probe below is a real action in packages/actions, not a wishlist entry.
Alibaba Cloud
RAM audit, OSS probe and public buckets, Container Registry URL patterns, ECS probe
Huawei Cloud
OBS storage access, Software Repository (SWR), account probe
IBM Cloud
Cloud Object Storage, Container Registry (ICR), account audit
OCI (Oracle)
Object storage probe, Container Registry URL patterns, HTTP endpoints, account probe
Tencent Cloud
COS object storage, TCR Container Registry, account probe
DigitalOcean
Spaces storage URL patterns, account audit
Linode
Object Storage URL patterns, account audit
Hetzner
Object Storage URL patterns, account audit
Scaleway, Vultr, OVH, Yandex
Object storage URL patterns and provider-specific probes for each
Coverage shape
Six detection surfaces, repeated across every cloud.
Skydra's cloud coverage is organised by what attackers do, not by what AWS, Azure, and GCP each call their service of the week.
Compute
Metadata service exposure, public virtual machines, serverless function URLs, container registry pulls, misconfigured code deploys.
Storage
Public buckets, overly-permissive CORS, directory listing, anonymous write, sensitive filename disclosure, dangling cloud buckets, CDN origin exposure.
Identity & secrets
IAM paths that permit privilege escalation, service accounts with cross-account trust, long-lived access keys, secrets left in environment variables and config files.
Network edge
Public API gateways, load balancer rules, SSRF-reachable metadata endpoints, DNS cache poisoning surface, outbound rate-limit controls on your own infrastructure.
Containers & orchestration
Public Kubernetes APIs, Docker daemons, container registries without auth, kubelet, Kubernetes dashboards, container escape probes.
CI/CD & artifacts
GitHub Actions workflows that can be pwned, package attestations, dependency-confusion checks, Argo CD exposure, Jenkins and Concourse-CI probes, Terraform Cloud posture.
How it stays honest
One engine, one evidence standard.
Skydra's cloud detectors use the same safety and evidence controls as the rest of the product.
Scope enforcement is on by default
A cloud audit runs only against accounts the workspace is authorized to inspect. Probing actions refuse to touch resources outside the allow-list, and the policy applies regardless of what a runbook author typed into a URL field.
Finding threshold
A public-by-design storage URL is a lead, not a finding. The audit turns into a finding only when a stronger check establishes the unsafe condition — anonymous read against a bucket with real contents, write succeeding against a probe object, or a provider API response that confirms the exposure.
Rate and concurrency controls
Fan-out across hundreds of thousands of resources is a workflow property. Per-run concurrency caps, per-workspace rate limits, and action-level timeouts prevent one scan from degrading another or from hitting a provider throttle.
Short-lived credentials only
Cloud credentials are sealed in the vault; the runbook graph never carries plaintext. Where a provider supports it, Skydra uses short-lived credentials — the console itself never holds a long-lived AWS key.
Pick the provider you want to see first.
Each provider page breaks down the specific detectors, the finding evidence they produce, and the known coverage gaps — honest about what the product checks and what it does not.