Cloud Analyzer
Scans your AWS, Azure, and GCP accounts for quantum-vulnerable cryptography in the managed services you run: the TLS policies on load balancers, CDN distributions, and API gateways, and the encryption and TLS settings of storage, databases, and secrets. Results are scored with the same unified Quantum Risk Engine as every other Rivet analyzer.
Account-wide discovery with a credential you issue. Like the Key Management Analyzer, the Cloud Analyzer reads live configuration through your cloud provider's own APIs, using a read-only credential you create and scope yourself. It reads configuration only and never changes a resource.
Supported Providers
| Provider | What it scans | Credential type |
|---|---|---|
| AWS | Elastic Load Balancer listeners, CloudFront distributions, API Gateway custom domains, S3 bucket encryption and TLS enforcement, RDS storage encryption and TLS certificates, EBS volume encryption, Secrets Manager secrets, CloudHSM clusters | IAM Access Key |
| Azure | Application Gateway SSL policies, Storage Account TLS settings, SQL Server minimum TLS version | Service Principal (Tenant ID + Client ID + Client Secret) |
| GCP | Cloud Load Balancing SSL policies, including whether post-quantum key exchange is enabled, Cloud Storage bucket encryption, Cloud SQL TLS enforcement, Secret Manager | Service Account JSON key |
Keys and certificates held in AWS KMS, AWS Certificate Manager, Azure Key Vault, Azure Managed HSM, and GCP Cloud KMS are covered by the Key Management Analyzer.
Running a Scan
- Open Cloud Analyzer in the sidebar and click Add Connection.
- Choose a provider and enter the connection details and credential.
- Click Test Connection to confirm access, then save.
- Click Scan. Rivet enumerates the supported resources the credential can see and assesses each one.
From a terminal, the same scans run as rivet scan-aws-account, rivet scan-azure-account, and rivet scan-gcp-account, and through the MCP server for automated and AI-assisted workflows.
What Gets Assessed
- TLS policies. Whether a load balancer, CDN, or API gateway policy offers TLS 1.3, requires it, and (where the provider supports it) enables hybrid post-quantum key exchange. A policy that still allows TLS 1.0 or 1.1 is flagged as blocking migration.
- Encryption at rest. Whether storage, databases, volumes, and secrets are encrypted, and with what kind of key.
- TLS enforcement. Whether storage and database services require encrypted connections, and which certificate authority a database uses.
- HSM clusters. CloudHSM cluster inventory for your post-quantum migration planning.
Coverage States
Every scan reports how much of the account it could read:
| State | What it means |
|---|---|
| Complete | Every supported service was read. |
| Partial | Some resources or services could not be read (for example, the credential lacks permission). They are listed with the reason, and the risk score is a lower bound. |
| Incomplete | Nothing could be read, so there is no score. |
A resource Rivet is not permitted to read is reported as not assessed rather than scored. The CLI exits 0 when clean, 1 with findings, 2 on error, and 3 when the scan was incomplete; add --allow-incomplete to accept partial coverage in CI.
Credential Model
- AWS: an IAM Access Key attached to a read-only policy limited to the describe, list, and get actions for the services above. The full minimum policy is in the User Guide.
- Azure: a Service Principal with a read-only role on the subscription or resource groups to scan.
- GCP: a Service Account JSON key with a read-only role on the project.
Saved connections keep the credential only in your machine's operating system credential manager (Windows Credential Manager, macOS Keychain, or Linux Secret Service), never in Rivet's database and never transmitted to Cerebion. The CLI takes credentials at scan time and does not store them.
Results and Exports
Each scan is saved to history with its coverage state, resource count, and risk score, and appears on the Dashboard, in Reports, and in the CBOM. Results export as CSV, HTML, and SARIF.
Limitations
- A clean result reflects what the credential can see. Resources outside its permissions, regions it cannot reach, and services Rivet does not yet support are not assessed.
- The assessment is based on the configuration your cloud provider reports for each resource. It does not connect to the workloads behind it; use the Certificate and Network Analyzers for live endpoint checks.
Relationship to Other Analyzers
The Cloud Analyzer uses the same 4-component risk engine and 0 to 100 scale as every other analyzer. See Risk Scoring for the methodology.