Amnify Cloud

Amnify Cloud is a cloud security posture module of the Amnify platform. It runs configuration checks against AWS, Azure and Google Cloud and uses an agent to map each result to the organization's code and context, so that only relevant findings remain. How it works: - Reads resource configuration through the cloud providers' own APIs with read-only access. On AWS it uses a scan role, on Azure the Amnify enterprise application, and on Google Cloud a service account owned by the customer. - Users select which accounts, subscriptions and projects to scan, then run a first scan manually and schedule later scans daily, weekly or monthly per scope. - Includes over a thousand checks recommended by AWS, Azure, Google Cloud and compliance frameworks. What it checks: - Misconfiguration across compute, storage, networking, databases, containers and managed services - Over-permissive identity, including wildcard and admin permissions, privilege escalation paths, stale credentials and unrotated keys - Public data exposure of storage, databases, snapshots and endpoints - Encryption gaps at rest and in transit, and keys without rotation - Logging and audit gaps - On Azure, an optional directory tier covers privileged roles, conditional access, legacy authentication and MFA registration Finding handling: - Failed checks are grouped into one finding per resource, grouped by module where applicable. - Findings are judged against documented context, and results for resources documented as intentionally public can be suppressed with a recorded reason. Sandbox findings rank below production ones. - An agent traces a resource to the repository and file that define it, merging the cloud and infrastructure-code results into one finding. Remediation: - For resources defined as code, the fix is a pull request against the defining code. - For other cases, a task is assigned to a person with a runbook of steps. - Findings resolve automatically when a later scan shows the control passing.