Blue Heron Digital Services

Blue Heron Digital Services, LLC · Lakeland, FL

Cloud Security Quick Scan

Upload the security CSVs you can download yourself, or a cloud cost export. You get a score out of 100. The existing read-only cost connection is not given new permissions. We reply within 2 business days.

  1. 1Download a credential report, firewall rules, a storage export, or Defender recommendations. The clicks are below.
  2. 2Drop the CSVs here. A cost export is accepted, and it will say what it cannot see.
  3. 3The free page shows the score and category counts. Names, fix steps, and missing read permissions are in the paid Cloud Cost Audit. You make the changes yourself.

Looking for a cloud bill? Use Cloud Bill Check.

Send the CSVs

Email and at least one CSV. No new cloud permission is requested.

The free page shows a score and category counts. Resource names and fix steps stay in the paid Cloud Cost Audit. Scott replies within 2 business days.

Where to download each file

AWS

IAM credential report

Root MFA, admin MFA, and access key age.

  1. 1Open the AWS console and go to IAM.
  2. 2In the left menu, open Credential report. If you do not see it, open the IAM dashboard and use the credential report there.
  3. 3Select Download report. If AWS says the report is generating, wait and download the CSV.

The cost reader role cannot download this report. You download it yourself. This site does not add iam:GetCredentialReport.

Any cloud

Firewall or security group rules

Inbound rules that allow admin or database ports from the internet.

  1. 1AWS: open VPC, then Security groups. Export the inbound rules if the table offers a CSV, or save a sheet with group name, direction, source, port, and allow or deny.
  2. 2Azure: open Network security groups, then a group, then Inbound security rules. A CSV with name, direction, source, destination port, and access is enough.
  3. 3Google Cloud: open VPC network, then Firewall. Export or copy rules with direction, source ranges, and ports.

The AWS cost role already allows ec2:Describe*. This scan does not call it and does not change the role.

Any cloud

Storage public access

Accounts or buckets that still allow public blobs.

  1. 1Azure: open Storage accounts and export the list if it includes Allow blob public access or Public access.
  2. 2AWS: a CSV with the bucket name and whether Block Public Access is on is enough. The S3 console does not always offer one download for every bucket.
  3. 3If the export has no public-access column, skip it. The score will say storage was not checked.

Azure Reader could read this, and S3 would need extra read actions. This scan does not add either call.

Optional

Defender, Security Hub, or logging status

Controls marked unhealthy, failed, or off.

  1. 1Azure: open Microsoft Defender for Cloud, then Recommendations, then Download CSV.
  2. 2AWS: open Security Hub or Trusted Advisor and download the security findings if a CSV is offered.
  3. 3A two-column sheet also works: Setting and Status, with rows such as CloudTrail and Off.

Defender pricing and CloudTrail status are not on the cost reader role. Download the CSV yourself.