Cloud computing services provide scalable and cost-effective solutions for
data storage, processing, and collaboration. Alongside their growing
popularity, concerns related to their security vulnerabilities leading to data
breaches and sophisticated attacks such as ransomware are growing. To address
these, first, we propose a generic framework to express relations between
different cloud objects such as users, datastores, security roles, to model
access control policies in cloud systems. Access control misconfigurations are
often the primary driver for cloud attacks. Second, we develop a PDDL model for
detecting security vulnerabilities which can for example lead to widespread
attacks such as ransomware, sensitive data exfiltration among others. A planner
can then generate attacks to identify such vulnerabilities in the cloud.
Finally, we test our approach on 14 real Amazon AWS cloud configurations of
different commercial organizations. Our system can identify a broad range of
security vulnerabilities, which state-of-the-art industry tools cannot detect.

云计算服务、安全漏洞、访问控制策略、PDDL 模型和亚马逊 AWS 云配置是本研究的五个关键词，该研究提出了一个通用框架来表达云系统中不同云对象之间的关系，以建立访问控制策略，并使用 PDDL 模型检测安全漏洞，从而测试 14 个真实的亚马逊 AWS 云配置中的安全性漏洞。