To allow us to complete the Cloud Security Audit we will require a provisioned cloud account and assignment of relevant privileges to access your resources.

The email addresses of testers can be provided on request for this purpose.

Please contact us in advance of testing if you use an alternative authentication system for AWS accounts (e.g. Okta SSO) or utilise AWS Organizations with in-scope resources across multiple organisations as these instructions may differ depending on your specific setup.

Log into the AWS Console (https://console.aws.amazon.com) and select IAM -> Users.
Click the "Add user" button and provide the new user a descriptive name such as "onsecurity-audit".
Set the Access Type to "Programmatic access" only and click "Next: Permissions".
Select "Attach existing policies directly" and attach the "ReadOnlyAccess" and "SecurityAudit" AWS managed policies.
Click "Next: Tags" and optionally add any applicable tags e.g. "role: 2022 cloud security audit".
Click "Next: Review" and finally "Create User".
Once the user has been created, make a note of Access Key ID and Secret Access Key values.

Browse to the user again click "Add Inline Policy" and then paste in the following JSON:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ds:ListAuthorizedApplications",
                "ec2:GetEbsEncryptionByDefault",
                "ecr:Describe*",
                "support:Describe*",
                "tag:GetTagKeys",
                "lambda:GetFunction",
                "glue:GetConnections",
                "glue:SearchTables",
                "s3:GetAccountPublicAccessBlock"
            ],
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "OnSecAdditionalPentestPerms"
        }
    ]
}

Name this policy something easy to remember e.g. "OnSecurity Additional Permissions" and click "Create Policy".
Send the access and secret key information to us securely via the OnSecurity File Transfer area. Please be aware that this is the only time the Secret Key will be revealed. If you wish for additional security peace of mind, you can also encrypt this information and send the password out-of-bound to a tester's email or via a secure messaging platform.

Go to the Azure Portal (https://portal.azure.com) and make sure you are logged into the desired directory.
From the top left menu, select Azure Active Directory and then Users.
Click "New User" and then "Invite User".
Enter the OnSecurity provided tester email address in the "Email Address" field.
Under Groups and Roles, apply the “GlobalReader” and “SecurityReader” roles to the user.
Click "Invite".
Return to the Azure Dashboard and select "Subscriptions".
Select the appropriate subscription and click "Access Control (IAM)".
Click "Add -> Add role assignment".
Select the role "GlobalReader" and click on the OnSecurity guest user below, then click "Save".
Repeat the above step with the "SecurityReader" roles.

Go to the GCP Console (https://console.cloud.google.com) and select the appropriate project.
Click on IAM & Admin -> IAM.
Click on the "Add" at the top.
Enter the OnSecurity provided tester email address in the "New members" field.
Click "Select a role" and select the following roles: "Viewer", "Security Reviewer" and "Stackdriver Accounts Viewer".
Check "Send notification email" and click on Save.