Cloud provider integrations give LowerPlane visibility into your infrastructure security posture. By connecting your cloud accounts, you enable automated evidence collection for access controls, encryption settings, network configurations, logging, and resource inventories.

​
Supported Cloud Providers

AWS

Amazon Web Services including Security Hub, Config, CloudTrail, IAM, GuardDuty, Inspector, and ECR.

Azure

Microsoft Azure including Defender for Cloud, Entra ID (Azure AD), DevOps, Container Registry, and Gov Cloud.

Google Cloud

Google Cloud Platform including Security Center, Cloud Asset API, Container Registry, and Cloud Storage.
Additional cloud providers supported: DigitalOcean, Heroku, Cloudflare, Netlify, Vercel, Render, Scaleway, Oracle Cloud, and AWS Gov Cloud / Azure Gov Cloud.

​
AWS Integration

AWS is connected using an IAM role or API access keys. LowerPlane reads data from multiple AWS services to build a comprehensive security picture.

​
Services Monitored

​
Evidence Collected

  • IAM password policy configuration
  • MFA enforcement status for all IAM users
  • S3 bucket encryption and public access settings
  • CloudTrail logging enabled across all regions
  • VPC flow log configuration
  • Security group rules and network ACLs
  • Root account usage and access key status
Enable AWS Security Hub with the AWS Foundational Security Best Practices standard before connecting. This gives LowerPlane the richest set of findings to work with and maps directly to multiple compliance controls.

​
Azure Integration

Azure connects through an App Registration (service principal) with read-only permissions across your subscription.

​
Services Monitored

​
Evidence Collected

  • Conditional access policy configurations
  • MFA registration and enforcement status
  • Network security group rules
  • Storage account encryption settings
  • Azure Policy compliance state
  • Diagnostic logging configuration
If your organization uses both Azure AD for identity and Azure for infrastructure, you may need two separate connections: one for the identity provider (Entra ID) and one for the cloud subscription.

​
Google Cloud Integration

GCP connects using a service account with read-only IAM roles.

​
Services Monitored

​
Evidence Collected

  • Organization policy constraints
  • VPC firewall rules
  • Cloud Storage bucket IAM and encryption settings
  • Service account key rotation status
  • Audit log sink configuration
  • Binary authorization policies for GKE

​
What Controls Are Covered

Cloud provider integrations contribute evidence to controls across all 50+ frameworks:

​
Automated Tests

When a cloud provider is connected, LowerPlane automatically creates and runs tests such as:
  • MFA is enabled for all IAM users with console access
  • Encryption at rest is enabled for all storage resources
  • Logging is enabled across all regions and services
  • No storage buckets or blobs are publicly accessible
  • Root/owner account access keys are disabled or rotated
  • Network security groups do not allow unrestricted inbound access
  • API activity logging captures all management events
Cloud provider syncs can take several minutes for large accounts with thousands of resources. The initial sync is the longest. Subsequent syncs are incremental and complete faster.

​
Connection Requirements

LowerPlane operates in read-only mode. It never creates, modifies, or deletes resources in your cloud accounts. The permissions listed above are sufficient for full evidence collection.

​
Multi-Account and Multi-Region

For organizations with multiple cloud accounts or regions:
  • AWS: Connect each account individually, or use an organization-level IAM role with sts:AssumeRole permissions for member accounts.
  • Azure: Connect each subscription. A single App Registration can be granted access across multiple subscriptions.
  • GCP: Connect each project, or grant the service account access at the organization or folder level.
Prioritize connecting production accounts first. These are the accounts auditors focus on, and they provide the highest compliance coverage.