Which clouds does cloud-enum cover?

AWS, Azure, and Google Cloud in one run. Turn off any provider you do not need with --disable-aws, --disable-gcp, or --disable-azure to trim the scan to a subset.

Does cloud-enum need cloud credentials?

No. It brute-forces public names from the outside and reports which ones exist and whether they are open, so it finds exposed resources without any access to the target's accounts.

How does cloud-enum find exposed cloud resources?

It expands your keyword into candidate bucket, container, and app names using a mutations list, then requests each name and records whether it is open or protected. --mutations widens the candidate list; --quickscan skips mutations and second-level scans for a fast first pass.

How do I widen or speed up the search?

Widen it with a larger --mutations file or several base keywords through --keyfile. Speed it up by raising --threads above the default of 5, or narrow scope with --quickscan and the --disable- flags.

What output formats does cloud-enum support?

Set --format to text, json, or csv for the log file; it defaults to text. JSON or CSV is easier to parse when a later Trickest node consumes the results.

cloud-enum or cloudlist?

cloud-enum guesses public names from outside with no credentials, so it catches resources a target left exposed. cloudlist inventories assets inside accounts you already hold credentials for. Use cloud-enum for external discovery and cloudlist for owned-account audits.

Updated Jul 14, 2026

Recon

Find public cloud resources across AWS, Azure, and GCP

A multi-cloud enumeration utility for AWS, Azure, and GCP.

Find exposed cloud storage Sweep all three clouds at once Expand a keyword with mutations

overview

What cloud-enum does

cloud-enum hunts for public cloud resources tied to a target by brute-forcing names across AWS, Azure, and Google Cloud at once. Give it a keyword such as a company or product name and it generates candidate bucket, container, and app names, then checks which ones exist and whether they are open. Misconfigured public storage is one of the most common ways data leaks, and cloud-enum is built to find it across all three major providers from a single run.

Mutations and a brute-force list expand a keyword into many realistic variants, while quickscan trims the run to a fast first pass. You can disable any provider you do not care about, point it at a custom nameserver, and choose text, JSON, or CSV output for the log.

On Trickest, cloud-enum is a Recon node that takes a keyword and writes a file and a folder of results. Run it during attack-surface discovery to find exposed cloud assets, then route discovered resources into a cloud-specific scanner or a manual review queue.

source github.com/initstring/cloud_enum

use cases

Where cloud-enum fits

Find exposed cloud storage

Brute-force bucket and container names from a keyword across AWS, Azure, and GCP to catch public storage a target left open.

Sweep all three clouds at once

Run one keyword against AWS, Azure, and Google so a single pass covers an organization's full multi-cloud footprint.

Expand a keyword with mutations

Point --mutations at a wordlist to generate realistic name variants, widening the search beyond the obvious base name.

Run a fast first pass

Enable quickscan to skip mutations and second-level scans when you want a quick read on a target's exposure.

reference

cloud-enum inputs and flags

11 inputs

Name	Type	Flag	Description
keyword	STRING	--keyword	Bruteforce keyword the search is built from.
keywords-file	FILE	--keyfile	Input file with a single keyword per line.
mutations	FILE	--mutations	Mutations list to expand keywords (default fuzz.txt).
brute	FILE	--brute	List to brute-force Azure container names.
format	STRING	--format	Format for the log file (text, json, csv).
threads	STRING	--threads	Threads for HTTP brute-force (default 5).
quickscan	BOOLEAN	--quickscan	Disable all mutations and second-level scans.
nameserver	STRING	--nameserver	DNS server to use in the brute-force.

Showing key inputs. cloud-enum exposes 11 inputs in total.

Full flag reference (11 inputs)

Name	Type	Flag	Description
brute	FILE	--brute	List to brute-force Azure container names. Default: enum_tools/fuzz.txt
format	STRING	--format	Format for log file (text, json, csv - defaults to text)
keyword	STRING	--keyword	Bruteforce keyword
threads	STRING	--threads	Threads for HTTP brute-force. Default = 5
mutations	FILE	--mutations	Mutations. Default: enum_tools/fuzz.txt
quickscan	BOOLEAN	--quickscan	Disable all mutations and second-level scans
nameserver	STRING	--nameserver	DNS server to use in brute-force
disable-aws	BOOLEAN	--disable-aws	Disable Amazon checks
disable-gcp	BOOLEAN	--disable-gcp	Disable Google checks
disable-azure	BOOLEAN	--disable-azure	Disable Azure checks
keywords-file	FILE	--keyfile	Input file with a single keyword per line

example

Run cloud-enum

cloud-enum · command

# enumerate public buckets, containers, and apps across all three cloudscloud_enum --keyword example --mutations enum_tools/fuzz.txt --threads 10 --format json

sample output

[+] Checking for S3 buckets  OPEN S3 BUCKET: http://example-dev.s3.amazonaws.com/  PROTECTED S3 BUCKET: http://example-backups.s3.amazonaws.com/[+] Checking for Azure Storage Accounts  OPEN AZURE CONTAINER: https://exampleassets.blob.core.windows.net/public/[+] Checking for Google buckets  OPEN GOOGLE BUCKET: https://storage.googleapis.com/example-static/  PROTECTED GOOGLE BUCKET: https://storage.googleapis.com/example-logs/[+] All done, 4 open or protected resources across 3 clouds

guidance

Choosing cloud-enum

Reach for cloud-enum when you want to find public buckets, containers, and apps across AWS, Azure, and GCP from a keyword. It guesses names rather than reading provider accounts, so for listing assets in accounts you control, use cloudlist instead.

cloudlist

Lists assets from cloud accounts you hold credentials for. cloud-enum guesses public names from outside.

s3scanner

Focuses on S3 bucket discovery and permissions. cloud-enum covers AWS, Azure, and GCP together.

cloud_enum

Same project upstream. On Trickest this node wraps it for multi-cloud brute-forcing in a workflow.

faq

cloud-enum questions

Pass a base keyword with --keyword, or a file of keywords with --keyfile, and cloud_enum brute-forces resource names across all three providers. On Trickest, set the node's keyword input instead of the flag. The upstream project is initstring/cloud_enum.

Run cloud-enum yourself

A keyword feeds cloud-enum, which brute-forces names across AWS, Azure, and GCP and writes the public cloud resources it finds as output.

Run cloud-enum in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

keyword

STRING

--keyword

Bruteforce keyword the search is built from.

keywords-file

FILE

--keyfile

Input file with a single keyword per line.

mutations

FILE

--mutations

Mutations list to expand keywords (default fuzz.txt).

brute

FILE

--brute

List to brute-force Azure container names.

format

STRING

--format

Format for the log file (text, json, csv).

threads

STRING

--threads

Threads for HTTP brute-force (default 5).

quickscan

BOOLEAN

--quickscan

Disable all mutations and second-level scans.

nameserver

STRING

--nameserver

DNS server to use in the brute-force.

Name

Type

Flag

Description

brute

FILE

--brute

List to brute-force Azure container names. Default: enum_tools/fuzz.txt

format

STRING

--format

Format for log file (text, json, csv - defaults to text)

keyword

STRING

--keyword

Bruteforce keyword

threads

STRING

--threads

Threads for HTTP brute-force. Default = 5

mutations

FILE

--mutations

Mutations. Default: enum_tools/fuzz.txt

quickscan

BOOLEAN

--quickscan

Disable all mutations and second-level scans

nameserver

STRING

--nameserver

DNS server to use in brute-force

disable-aws

BOOLEAN

--disable-aws

Disable Amazon checks

disable-gcp

BOOLEAN

--disable-gcp

Disable Google checks

disable-azure

BOOLEAN

--disable-azure

Disable Azure checks

keywords-file

FILE

--keyfile

Input file with a single keyword per line

[+] Checking for S3 buckets OPEN S3 BUCKET: http://example-dev.s3.amazonaws.com/ PROTECTED S3 BUCKET: http://example-backups.s3.amazonaws.com/[+] Checking for Azure Storage Accounts OPEN AZURE CONTAINER: https://exampleassets.blob.core.windows.net/public/[+] Checking for Google buckets OPEN GOOGLE BUCKET: https://storage.googleapis.com/example-static/ PROTECTED GOOGLE BUCKET: https://storage.googleapis.com/example-logs/[+] All done, 4 open or protected resources across 3 clouds

Find public cloud resources across AWS, Azure, and GCP

What cloud-enum does

Where cloud-enum fits

Find exposed cloud storage

Sweep all three clouds at once

Expand a keyword with mutations

Run a fast first pass

cloud-enum inputs and flags

Run cloud-enum

Choosing cloud-enum

cloudlist

s3scanner

cloud_enum

cloud-enum questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run cloud-enum yourself

Find public cloud resources across AWS, Azure, and GCP

What cloud-enum does

Where cloud-enum fits

Find exposed cloud storage

Sweep all three clouds at once

Expand a keyword with mutations

Run a fast first pass

cloud-enum inputs and flags

Run cloud-enum

Choosing cloud-enum

cloudlist

s3scanner

cloud_enum

cloud-enum questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run cloud-enum yourself