Overview
Modern organizations use cloud assets — storage buckets, cloud services, and hosted infrastructure — which can be part of the in-scope surface and a source of findings. This lesson covers cloud-asset discovery.
Learning objectives
- Explain cloud assets in the discovery context.
- Identify common cloud asset types and their risks.
- Connect cloud discovery to scope and common findings.
Core concept
Cloud assets are resources hosted in cloud platforms that an organization uses — such as object-storage buckets, cloud-hosted applications/services, and related infrastructure. In discovery, identifying an organization's in-scope cloud assets matters because misconfigured cloud resources are a common source of findings — for example, publicly accessible storage buckets exposing sensitive data, or misconfigured cloud services. Cloud assets may be referenced by applications (e.g. a storage bucket serving files) or discoverable via naming patterns, and — as always — must be verified in-scope (and not an excluded third party) before testing.
How it works
The researcher identifies cloud assets the in-scope organization uses — for instance, storage buckets referenced by its applications, or cloud-hosted services under its domains. They then assess (within scope) whether these are misconfigured: is a storage bucket publicly readable/writable when it shouldn't be? Is a cloud service exposed or misconfigured? Publicly-exposed buckets are a classic finding (sensitive data exposure). Crucially, cloud assets must be checked against scope — some cloud resources may be out of scope or belong to third-party providers the organization cannot authorize testing on, so verification is essential before any testing.
Practical example
Discovering assets, the researcher notices an application loads files from a cloud storage bucket. Verifying the bucket is the organization's and in-scope, they check its configuration and find it is publicly readable, exposing files that should be private — a common cloud misconfiguration and a valid finding (sensitive data exposure), reported with evidence. Had the bucket been out-of-scope or a third-party's, the researcher would not have tested it. Cloud-asset discovery surfaced a real, in-scope issue that a UI-only view would have missed.
Cybersecurity relevance
Cloud assets are an increasingly important part of the attack surface, and cloud misconfigurations — especially publicly-exposed storage buckets — are a common, high-impact source of bug bounty findings (sensitive data exposure) and real breaches. Discovering in-scope cloud assets and checking their configuration is thus valuable, tying to the cloud-related concepts from the web-security SSRF/cloud-metadata material. Scope care is critical: cloud resources may be out-of-scope or third-party (unauthorizable). For defenders, it underscores securing cloud configurations (least privilege, no unintended public access). In-scope cloud discovery is a strong finding source.
Common mistakes
- Testing cloud assets without verifying they're in-scope (or are the org's, not a third party's).
- Overlooking cloud assets referenced by applications (e.g. storage buckets).
- Missing the classic misconfiguration of publicly-exposed storage.
Key takeaways
- Cloud assets (storage buckets, cloud services, hosted infrastructure) are part of the modern surface; misconfigurations (esp. public storage buckets) are a common finding source.
- Discover in-scope cloud assets (often referenced by applications) and assess their configuration for exposure — verifying scope, as some are out-of-scope or third-party.
- Cloud misconfigurations cause sensitive data exposure (tying to cloud/SSRF concepts); scope care is essential, and defenders should secure cloud configurations.
Check your understanding
- Why are misconfigured cloud storage buckets a common bug bounty finding?
- Why is scope verification especially important when discovering cloud assets?