Skip to main content
Amnify assesses each connected account, subscription and project against a broad set of configuration and identity checks. An agent then works out which results are genuinely exposed in your environment, and writes those up as findings.

​
What we check

Insecure service settings across compute, storage, networking, databases, containers, serverless and managed platform services. Defaults that are unsafe in production, deprecated configurations, and settings that silently weaken another control.
Wildcard and administrative permissions, roles and principals that can escalate privilege, unused and stale credentials, keys that have never been rotated, trust relationships that accept any principal, and privileged accounts without strong authentication.
Storage, databases, snapshots, images and endpoints reachable from the internet. Anonymous read or write access, and management interfaces exposed beyond an allowed network.
Encryption at rest or in transit disabled, platform managed keys where a customer managed key is required, weak transport settings, and key material without rotation.
Control plane audit logging disabled or incomplete, log retention below policy, logs stored without protection against tampering, and monitoring or alerting absent on security relevant events.
On Azure, with the optional directory tier: privileged role assignments, conditional access coverage, legacy authentication exposure, and multi factor authentication registration.

​
What we never touch

Access is read only, and it is configuration only.
  • No create, modify or delete on any resource.
  • No access to what is inside a resource. Amnify reads configuration, not content.
See Sources for exactly what is requested per provider and why.

​
From check to finding

A cloud finding is identified by the resource and the control that failed, not by the scan that found it. When a later scan shows the issue is no longer failing, the finding is resolved immediately.

​
Tracing back to code

For a cloud finding, an agent investigates which repository and file define the resource, and records the link. This is what lets a cloud problem be fixed as a pull request against your infrastructure as code rather than as a manual click in a console. See Context.

​
Scope

Each connection covers one account, subscription or project at a time, and only the ones you select. Nothing outside your selection is enumerated or assessed.