Cloud Mapping

A map of what runs in your AWS, Azure and GCP accounts, built from a read-only scan of each one.

What It Does

Zonitix scans your AWS, Azure and GCP accounts to build a point-in-time topology map that re-syncs on a schedule (daily by default) and whenever you refresh it. It visually highlights databases, file storages, and virtual machines.

Refresh Behaviour

The map is a point-in-time snapshot served from cache, not a live view. Request a refresh explicitly to re-scan. Every connected cloud (AWS, Azure and GCP) also re-syncs on a schedule — daily by default, and the interval you configure applies per cloud. Each scan on any of the three clouds also writes a historical snapshot. The Changes tab compares the current map with the previous snapshot by default, or any two saved snapshots you pick.

A rules pass runs over the resulting graph and raises findings such as world-open security groups, exposed RDP/SSH, public or unencrypted databases, unencrypted volumes, S3 buckets without versioning, a public EKS API endpoint, KMS keys, secrets, SNS topics or SQS queues whose policy allows any principal, stale or unused access keys, and missing MFA. These are configuration checks against the data already pulled — nothing is probed or attacked.

Reading The Map

• Findings are the per-resource rules described above. Each carries an indicative mapping to control families in CIS AWS Foundations, PCI DSS, SOC 2 and NIST 800-53 — a starting point for an auditor, not an attestation.
• Conflicts are four network rules: a VPC main route table that routes to the internet, a resource with a public address but no internet route, a database reachable from the internet, and a route table with a blackhole route.
• Attack Paths chain existing results into a ranked list: an internet-exposed workload, the role it runs as, and the sensitive data or admin rights that role reaches. It is a traversal of data already scanned, not a new probe.
• Priorities is the opening view: resources ranked by risk, with a TOXIC tag where several risks stack on one resource. It has four optional AI helpers, all advisory and all run on the local model: a plain-English filter (Ask AI), Explain with AI on a priority, Summarize with AI (what to fix first) and Find toxic combos (AI). The ranked list itself does not depend on them.
• Identity Risks joins cloud principals to your employee directory and raises four types: Departed-employee key, Orphaned access key (no matching owner), No MFA, and Stale access key (older than 90 days). The key-based types can be sent to identity remediation when the finding carries a key id; No MFA never can.

If something here is not working as you expect, start with When something goes wrong.

Connection & Scan Specs

Cloud Mapping reads each cloud with a read-only identity. AWS is shown first: it uses a read-only IAM principal to read resource, network and identity configuration. Azure and GCP are covered in the runbook below.

Attach the AWS-managed ReadOnlyAccess policy (or SecurityAudit) to that principal. A narrow hand-written policy is not enough: the connection check requires iam:ListUsers to pass before the hook is verified, and the scan reads IAM, S3 bucket settings, Lambda, load balancers, ECS, EKS, KMS, Secrets Manager, SNS, SQS, DynamoDB, GuardDuty and Security Hub as well as EC2 and RDS. If you do scope your own policy it must still include iam:List* and iam:Get*, or the hook never verifies and no map is drawn. The cost view calls Cost Explorer (ce:GetCostAndUsage).

Connecting A Cloud Account

The steps on the Zonitix screens are in the guide Connect AWS, Azure or GCP. This section gives what has to exist in each cloud account first, what a scan reads, and the permissions involved.

Connecting a cloud account uses the same hook wizard as an identity provider. To create one you need manage_hooks or manage_integrations; to view the resulting map you need view_cloud_infrastructure.

AWS

Two ways in. You can paste an IAM access key pair, or have Zonitix assume a role in your account.

1. Create an IAM role in your AWS account and attach ReadOnlyAccess.
2. On its trust policy, allow Zonitix to sts:AssumeRole, conditioned on sts:ExternalId matching the External ID you set in Zonitix. That condition is what stops a third party who learns your role ARN from assuming it — do not skip it.
3. In Zonitix, fill roleArn and externalId and set region. Contact Zonitix support before using a role, so the trust policy names the right identity (see the note below on the key fields).

The scan reads S3 buckets (with public-access-block, encryption and versioning state), IAM users and roles with their attached policies (including policies granted through groups) and MFA status, and then per active region: VPCs, subnets, route tables, EC2, RDS, Lambda, security groups, NACLs, NAT gateways, peering, load balancers with target health, EKS and ECS clusters, KMS keys, Secrets Manager secrets, SNS topics, SQS queues and DynamoDB tables. If GuardDuty or Security Hub is enabled in a region, their existing findings are pulled onto the map too (up to 200 from each per region). Cost data comes from AWS Cost Explorer — six months of monthly spend by service.

Azure

Azure reuses the same app registration as directory sync (tenantId, clientId, clientSecret) — but resource discovery is a separate authorization system from Microsoft Graph. A Graph permission grants nothing in Azure Resource Manager and vice versa.

So in addition to the Graph permission you granted for directory sync: Subscriptions → your subscription → Access control (IAM) → Add role assignment → Reader, assigned to the app registration. Assign it at subscription scope, not resource-group scope.

Discovery pulls virtual networks, VMs with live power state, NSGs, storage accounts, SQL servers with their databases and firewall rules, NICs, public IPs, and role assignments resolved to readable role names. Cost data comes from Azure Cost Management.

One thing to set deliberately: a hook maps one subscription. Put the subscription you want in the Subscription ID field and Zonitix validates the app registration can actually reach it. Leave it blank and it maps whichever subscription ARM returns first — and tells you in the logs that it picked one of several, rather than quietly implying the map is complete. Invoice sync calls the real Azure Cost Management API and fails loudly if it can’t.

Google Cloud (GCP)

GCP discovery authenticates with a service-account key. Create a service account in the project you want to map, grant it the Viewer and Security Reviewer roles on the project, download its JSON key, and paste that key plus the Project ID into the GCP hook. As with Azure, one hook maps one project.

Discovery builds the same node-and-edge resource graph it does for AWS and Azure — your compute, network, and related resources and how they connect — cached as a point-in-time snapshot that re-syncs daily by default (on the GCP Sync Frequency you set) and whenever you refresh it. GCP mapping is gated by the same cloud-mapping entitlement as AWS and Azure, which is part of the Advanced plan.

Snapshot And Change Endpoints

Each of the four AI helpers on the Priorities view is refused with 503 when AI is switched off for the instance and 403 when the caller is not permitted to use AI.

If the map is empty but credentials validated: for Azure, an ARM call returning 200 with an empty subscription list means the identity holds no role assignment at all — that is a missing Reader role, not a bad secret. For AWS, confirm the assumed role actually carries read permissions in the regions you expect.

Executing A Fix — Cloud Remediation

Everything above only reads your cloud. Remediation is the separate, higher-privilege control that mutates it — deactivating an access key, revoking a security-group rule, blocking public S3. Two endpoints do this, and the single most important fact about both is that they default to dry run: as shipped they simulate the change, write an audit record, and touch nothing in your account.

These are the security-lab-service routes, where the permission, license and step-up gates are actually enforced. The api-gateway surfaces identity-remediate at /api/v1/auth/aws-identity-remediate/:providerId; the cloud-finding /security-lab/remediate route is defined in the service and is not exposed through the gateway as shipped.

Identity Remediation — Deactivate Leaked Keys (Step-Up Gated)

The stronger of the two controls. On top of manage_compliance or manage_security it requires a fresh step-up (requireSudo), so an ordinary admin session is not enough — the caller must have re-authenticated recently. A step-up counts for 15 minutes. The server reads the window from a stored setting, sudoTimeoutMinutes, and holds any value between 1 and 60 minutes, but no screen and no API route writes that setting, so every instance uses 15 minutes. The finding you post must be remediable and carry at least one key id, or the call is refused before anything is contacted.

Cloud Config Remediation — And The Argument-Injection Guard

The /security-lab/remediate engine maps a finding code to a fixed CLI command and runs it. The body carries code (required), plus resourceId and resourceLabel, which flow into the command’s arguments. Because those two are client-supplied, the controller validates both before the command is built — and the command runs through execFile, not a shell.

How An Inspector Verifies The Control