annatchijova·annatchijova/SKILLS/cloud-control-plane-reasoning/SKILL.md

cloud-control-plane-reasoning

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Reason about cloud compromise on the identity and control-plane graph, not the network diagram — because in cloud the control plane is an internet-reachable API authorized by credentials, it sits beside the data plane rather than above it behind a firewall, and a stolen key is one AssumeRole from the whole account. Use whenever the system is AWS/Azure/GCP/Kubernetes and the question is attack path, blast radius, privilege escalation, or "how bad is this": an SSRF that can reach the metadata endpoint, a leaked cloud key, an IAM/role/trust-policy review, `iam:PassRole` or `sts:AssumeRole` in a policy, a cross-account bucket policy, a service account or workload identity, a compromised container or CI runner in cloud. Trigger on "is this cloud config dangerous", "SSRF severity in cloud", "can they escalate from this role", "cross-account trust", "instance metadata", "what does this service account reach", "cloud lateral movement", or "model the blast radius in AWS/Azure/GCP". Sibling of assume-breach-modeling (this supplies the cloud-specific edges) and authorization-surface-mapping (IAM is its actor×resource×action grid). It does not configure the cloud or write Terraform, and it treats a network diagram alone as an incomplete model.