guest@geearr:~/services$ man geearr-cloud
NAME
geearr-cloud — cloud security by George Rios
Cloud Security: Cloud security without the 4,000-item findings list.
SYNOPSIS
geearr cloud [--iam] [--exposure] [--detection] [--zero-trust] <account>…DESCRIPTION
Most cloud breaches are not zero-days; they are an over-privileged role, a public bucket, a leaked key or a forgotten environment. George reviews your cloud the way an attacker would traverse it — from the internet, from a compromised workload, from a leaked credential — and turns the result into a short, prioritized list your engineers can actually close.
OPTIONS — WHAT GETS TESTED
--iam · Identity & access
- IAM privilege-escalation path analysis
- Least-privilege roles & permission boundaries
- Workload identity & key-less CI via OIDC federation
- Break-glass & root/owner account controls
- Cross-account & third-party trust review
--exposure · Exposure & data
- Public storage, snapshots & databases
- Security groups, WAF & edge configuration
- Secrets in env vars, images & state files
- Encryption, KMS key policies & rotation
- Backup integrity & restore testing
--detection · Detection & architecture
- CloudTrail / Activity Log / audit-log coverage
- Alerts on the events attackers actually trigger
- Zero Trust access: Cloudflare One, IAP, Entra
- Edge & serverless security: Workers, Lambda, Functions
- IaC guardrails: Terraform, Pulumi
OUTPUT — WHAT YOU GET
- 01Attack-path map from the internet and from a compromised workload
- 02Prioritized findings mapped to CIS Benchmarks
- 03Least-privilege IAM policies ready to apply
- 04Logging & detection gap analysis with rule suggestions
- 05Remediation pairing sessions with your platform team
EXAMPLES
$ geearr cloud --iam aws:prod path: ci-deployer → iam:PassRole → AdministratorAccess fix: scoped PassRole + permission boundary (diff attached)
$ geearr cloud --exposure --detection aws:prod azure:corp public: 2 snapshots · 1 storage container alerting gaps: 5 high-signal events not monitored
# illustrative output
CONFORMING TO
- CIS Benchmarks
- AWS Well-Architected (Security)
- Microsoft Cloud Security Benchmark
- NIST CSF 2.0
- CSA Cloud Controls Matrix
FAQ
[+][-]What does a cloud security assessment include?
A cloud security assessment reviews identity and access management, network exposure, data storage, secrets, encryption, logging and incident-detection coverage across your AWS, Azure, GCP or Cloudflare accounts. The goal is to identify realistic attack paths and fix the highest-impact misconfigurations first, not to produce thousands of low-value alerts.
[+][-]Which cloud platforms do you cover?
Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP) and Cloudflare — including Workers, Pages, R2, D1, Zero Trust and WAF. Hybrid environments and SaaS platforms such as GitHub, Microsoft 365 and Google Workspace are commonly included in scope.
SEE ALSO
glossary: attack-surface(7), least-privilege(7), iam-privilege-escalation(7), zero-trust(7), cspm(7)
shipped: engrave(8) — The black box recorder for AI agents., identizen(8) — Accountless identity.
services: geearr-pentest(1), geearr-appsec(1), geearr-email(1), geearr-ai(1)
EXIT STATUS
0 when every finding is closed and retested. Anything else means we keep going.
BUGS
None known. That’s what retests are for. Found one in this site? security.txt