Methodology: add org-guardrails and security-services checks

[carlospolop]

What

Adds two steps to the Basic Methodology of the Pentesting Cloud Methodology page. They round out the existing benchmark → services → exposure → permissions → integrations flow with two checks every cloud assessment should perform but that were previously only implicit:

1. Check organization-wide guardrails — the org-level controls that cap what every account/project/subscription below can do (they set the ceiling for everything else and are frequently missing or left in audit rather than deny mode):

   • AWS: SCPs / RCPs, clean management account.
   • GCP: key Organization Policy constraints, sane folder/project hierarchy.
   • Azure: Management Group hierarchy + Azure Policy with deny effects.
   • Plus who can weaken those guardrails.

2. Check security services are properly enabled — every finding is only detectable and recoverable if the cloud's detective/preventive services are on, protected and centralized (an attacker's first move is to blind them):

   • AWS: CloudTrail (multi-region org trail, log-file validation, immutable bucket in a separate logging account), GuardDuty, Config, Security Hub, IAM Access Analyzer.
   • GCP: Data Access audit logs (off by default), aggregated org log sink, Security Command Center, VPC Service Controls.
   • Azure: Defender for Cloud plans, centralized Activity + Entra ID diagnostic logs, Microsoft Sentinel.

Why

These are exactly the two additional steps now taught in the HackTricks Training white-box methodology lessons; this brings the public methodology in line with them.

Notes

• Only the Basic Methodology bullet list is touched; no <sup> reference markers were added or renumbered, so the numbered reference system is untouched.

🤖 Generated with Claude Code