Does cloud-enum need cloud credentials?

No. It brute-forces public names from the outside and reports which ones exist and whether they are open, so it finds exposed resources without access to the target's accounts.

How does cloud-enum find exposed cloud resources?

It expands your keyword into candidate bucket, container, and app names using a mutations list, then requests each name and records whether it is open or protected. --mutations widens the candidate list; --quickscan skips mutations and second-level scans.

How do I widen or speed up the search?

Widen with a larger --mutations file or several base keywords through --keyfile. Raise --threads above the default of 5, or narrow scope with --quickscan and --disable-aws, --disable-gcp, or --disable-azure.

What output formats does cloud-enum support?

Set --format to text, json, or csv for the log file; it defaults to text. JSON or CSV is easier to parse when a later node consumes the results.

cloud-enum or cloudlist?

cloud-enum guesses public names from outside with no credentials. cloudlist inventories assets inside accounts you already hold credentials for. Use cloud-enum for external discovery and cloudlist for owned-account audits.

Updated Jul 14, 2026

Recon

Find public cloud resources across AWS, Azure, and GCP

Multi-cloud public name enumeration for AWS, Azure, and GCP.

Find exposed cloud storage Sweep all three clouds at once Expand a keyword with mutations

overview

What cloud-enum does

cloud-enum expands a company or product keyword into candidate bucket, container, and app names, then probes AWS, Azure, and GCP for which exist and whether they are open.

Drive scope with --keyword or --keyfile, widen with --mutations, and cut depth with --quickscan. --format chooses text, json, or csv for the log. --disable-aws, --disable-gcp, and --disable-azure drop providers you do not need.

Guesses from outside with no credentials. For an inventory of accounts you already hold keys for, use cloudlist instead. Trickest runs it as a managed Recon node that writes FILE and FOLDER outputs.

source github.com/initstring/cloud_enum

use cases

Where cloud-enum fits

Find exposed cloud storage

Brute-force bucket and container names from a keyword across AWS, Azure, and GCP to catch public storage a target left open.

Sweep all three clouds at once

Run one keyword against AWS, Azure, and Google so a single pass covers an organization's full multi-cloud footprint.

Expand a keyword with mutations

Point --mutations at a wordlist to generate realistic name variants, widening the search beyond the obvious base name.

Run a fast first pass

Enable quickscan to skip mutations and second-level scans when you want a quick read on a target's exposure.

reference

cloud-enum inputs and flags

11 inputs

Name	Type	Flag	Description
keyword	STRING	--keyword	Bruteforce keyword the search is built from.
keywords-file	FILE	--keyfile	Input file with a single keyword per line.
mutations	FILE	--mutations	Mutations list to expand keywords (default fuzz.txt).
brute	FILE	--brute	List to brute-force Azure container names.
format	STRING	--format	Format for the log file (text, json, csv).
threads	STRING	--threads	Threads for HTTP brute-force (default 5).
quickscan	BOOLEAN	--quickscan	Disable all mutations and second-level scans.
nameserver	STRING	--nameserver	DNS server to use in the brute-force.

Showing key inputs. cloud-enum exposes 11 inputs in total.

Full flag reference (11 inputs)

Name	Type	Flag	Description
brute	FILE	--brute	List to brute-force Azure container names. Default: enum_tools/fuzz.txt
format	STRING	--format	Format for log file (text, json, csv - defaults to text)
keyword	STRING	--keyword	Bruteforce keyword
threads	STRING	--threads	Threads for HTTP brute-force. Default = 5
mutations	FILE	--mutations	Mutations. Default: enum_tools/fuzz.txt
quickscan	BOOLEAN	--quickscan	Disable all mutations and second-level scans
nameserver	STRING	--nameserver	DNS server to use in brute-force
disable-aws	BOOLEAN	--disable-aws	Disable Amazon checks
disable-gcp	BOOLEAN	--disable-gcp	Disable Google checks
disable-azure	BOOLEAN	--disable-azure	Disable Azure checks
keywords-file	FILE	--keyfile	Input file with a single keyword per line

example

Run cloud-enum

cloud-enum · command

# enumerate public buckets, containers, and apps across all three cloudscloud_enum --keyword example --mutations enum_tools/fuzz.txt --threads 10 --format json

sample output

[+] Checking for S3 buckets  OPEN S3 BUCKET: http://example-dev.s3.amazonaws.com/  PROTECTED S3 BUCKET: http://example-backups.s3.amazonaws.com/[+] Checking for Azure Storage Accounts  OPEN AZURE CONTAINER: https://exampleassets.blob.core.windows.net/public/[+] Checking for Google buckets  OPEN GOOGLE BUCKET: https://storage.googleapis.com/example-static/  PROTECTED GOOGLE BUCKET: https://storage.googleapis.com/example-logs/[+] All done, 4 open or protected resources across 3 clouds

guidance

Choosing cloud-enum

Reach for cloud-enum when you want public buckets, containers, and apps across AWS, Azure, and GCP from a keyword. It guesses names rather than reading provider accounts, so for listing assets in accounts you control, use cloudlist instead.

cloudlist

Lists assets from cloud accounts you hold credentials for. cloud-enum guesses public names from outside.

s3scanner

Focuses on S3 bucket discovery and permissions. cloud-enum covers AWS, Azure, and GCP together.

cloud_enum

Same project upstream. The managed node wraps it for multi-cloud brute-forcing in a workflow.

faq

cloud-enum questions

AWS, Azure, and Google Cloud in one run. Turn off any provider you do not need with --disable-aws, --disable-gcp, or --disable-azure.

Run cloud-enum yourself

A keyword feeds cloud-enum, which brute-forces names across AWS, Azure, and GCP and writes the public cloud resources it finds as output.

Run cloud-enum in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

keyword

STRING

--keyword

Bruteforce keyword the search is built from.

keywords-file

FILE

--keyfile

Input file with a single keyword per line.

mutations

FILE

--mutations

Mutations list to expand keywords (default fuzz.txt).

brute

FILE

--brute

List to brute-force Azure container names.

format

STRING

--format

Format for the log file (text, json, csv).

threads

STRING

--threads

Threads for HTTP brute-force (default 5).

quickscan

BOOLEAN

--quickscan

Disable all mutations and second-level scans.

nameserver

STRING

--nameserver

DNS server to use in the brute-force.

Name

Type

Flag

Description

brute

FILE

--brute

List to brute-force Azure container names. Default: enum_tools/fuzz.txt

format

STRING

--format

Format for log file (text, json, csv - defaults to text)

keyword

STRING

--keyword

Bruteforce keyword

threads

STRING

--threads

Threads for HTTP brute-force. Default = 5

mutations

FILE

--mutations

Mutations. Default: enum_tools/fuzz.txt

quickscan

BOOLEAN

--quickscan

Disable all mutations and second-level scans

nameserver

STRING

--nameserver

DNS server to use in brute-force

disable-aws

BOOLEAN

--disable-aws

Disable Amazon checks

disable-gcp

BOOLEAN

--disable-gcp

Disable Google checks

disable-azure

BOOLEAN

--disable-azure

Disable Azure checks

keywords-file

FILE

--keyfile

Input file with a single keyword per line

[+] Checking for S3 buckets OPEN S3 BUCKET: http://example-dev.s3.amazonaws.com/ PROTECTED S3 BUCKET: http://example-backups.s3.amazonaws.com/[+] Checking for Azure Storage Accounts OPEN AZURE CONTAINER: https://exampleassets.blob.core.windows.net/public/[+] Checking for Google buckets OPEN GOOGLE BUCKET: https://storage.googleapis.com/example-static/ PROTECTED GOOGLE BUCKET: https://storage.googleapis.com/example-logs/[+] All done, 4 open or protected resources across 3 clouds

Find public cloud resources across AWS, Azure, and GCP

What cloud-enum does

Where cloud-enum fits

Find exposed cloud storage

Sweep all three clouds at once

Expand a keyword with mutations

Run a fast first pass

cloud-enum inputs and flags

Run cloud-enum

Choosing cloud-enum

cloudlist

s3scanner

cloud_enum

cloud-enum questions

More Recon tools

amass

assetfinder

bevigil

cloudlist

dnsrecon

dnsx

Run cloud-enum yourself

Find public cloud resources across AWS, Azure, and GCP

What cloud-enum does

Where cloud-enum fits

Find exposed cloud storage

Sweep all three clouds at once

Expand a keyword with mutations

Run a fast first pass

cloud-enum inputs and flags

Run cloud-enum

Choosing cloud-enum

cloudlist

s3scanner

cloud_enum

cloud-enum questions

More Recon tools

amass

assetfinder

bevigil

cloudlist

dnsrecon

dnsx

Run cloud-enum yourself