> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amnify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud scanning

> What Amnify assesses across AWS, Azure and GCP, using read only access.

Amnify assesses each connected account, subscription and project against a broad set of configuration and identity checks. An agent then works out which results are genuinely exposed in your environment, and writes those up as findings.

## What we check

<AccordionGroup>
  <Accordion title="Misconfiguration" icon="sliders">
    Insecure service settings across compute, storage, networking, databases, containers, serverless and managed platform services. Defaults that are unsafe in production, deprecated configurations, and settings that silently weaken another control.
  </Accordion>

  <Accordion title="Over permissive identity" icon="user-lock">
    Wildcard and administrative permissions, roles and principals that can escalate privilege, unused and stale credentials, keys that have never been rotated, trust relationships that accept any principal, and privileged accounts without strong authentication.
  </Accordion>

  <Accordion title="Public data exposure" icon="globe">
    Storage, databases, snapshots, images and endpoints reachable from the internet. Anonymous read or write access, and management interfaces exposed beyond an allowed network.
  </Accordion>

  <Accordion title="Encryption gaps" icon="lock">
    Encryption at rest or in transit disabled, platform managed keys where a customer managed key is required, weak transport settings, and key material without rotation.
  </Accordion>

  <Accordion title="Logging and audit gaps" icon="scroll">
    Control plane audit logging disabled or incomplete, log retention below policy, logs stored without protection against tampering, and monitoring or alerting absent on security relevant events.
  </Accordion>

  <Accordion title="Identity layer, where granted" icon="fingerprint">
    On Azure, with the optional directory tier: privileged role assignments, conditional access coverage, legacy authentication exposure, and multi factor authentication registration.
  </Accordion>
</AccordionGroup>

## What we never touch

Access is read only, and it is configuration only.

* No create, modify or delete on any resource.
* No access to what is inside a resource. Amnify reads configuration, not content.

See [Sources](/connect/sources) for exactly what is requested per provider and why.

## From check to finding

```mermaid theme={null}
flowchart TB
  R["Check results per resource"] --> D["Deduplicate to one issue<br/>per resource"]
  D --> K["Judge against your context"]
  K --> O["Trace to the IaC that defines it"]
  O --> F["Finding"]
```

A cloud finding is identified by the resource and the control that failed, not by the scan that found it. When a later scan shows the issue is no longer failing, the finding is resolved immediately.

## Tracing back to code

For a cloud finding, an agent investigates which repository and file define the resource, and records the link. This is what lets a cloud problem be fixed as a pull request against your infrastructure as code rather than as a manual click in a console. See [Context](/knowledge/context).

## Scope

Each connection covers one account, subscription or project at a time, and only the ones you select. Nothing outside your selection is enumerated or assessed.