---
title: "Cloud EASM & Assets"
description: "Discover your external attack surface with authenticated multi-cloud API discovery across 9 providers, track new and removed assets, and launch one-click pentests from verified assets."
canonical: https://turbopentest.com/docs/assets/cloud-easm
source: "TurboPentest Docs"
---

# Cloud EASM & Assets

Cloud EASM (External Attack Surface Management) maps everything you expose to the internet by talking directly to your cloud providers' APIs. Unlike passive internet scanning, it uses **authenticated cloud API discovery** - you connect a provider, and TurboPentest enumerates the real resources in your account. Discovery is **free**: you only spend credits when you actually run a pentest.

## Connect a provider

Connect any of the 9 supported providers from **Dashboard > Assets** via OAuth or an API connection:

| Provider | Connection |
|----------|------------|
| **AWS** | Cross-account IAM role |
| **Azure** | API / OAuth |
| **GCP** | API / OAuth |
| **DigitalOcean** | API / OAuth |
| **Cloudflare** | API / OAuth |
| **DNSimple** | API / OAuth |
| **Netlify** | API / OAuth |
| **Replit** | API / OAuth |
| **Vercel** | API / OAuth |

Once connected, TurboPentest reads your account and inventories the resources that make up your external attack surface.

## What gets discovered

Discovery enumerates the internet-facing resources in your connected accounts. For AWS, for example, this includes:

- EC2 instances
- Application and Network Load Balancers (ALB/NLB)
- CloudFront distributions
- API Gateway endpoints
- AppSync APIs
- Lambda function URLs

Equivalent resource types are discovered across the other providers. Each discovered resource becomes an **asset** in your inventory.

## Asset sync: new and removed assets

TurboPentest runs a **periodic asset sync** that re-queries each connected provider and diffs the latest snapshot against your last-known inventory. The diff flags:

- **New assets** - resources that appeared since the last sync
- **Removed assets** - resources that no longer exist in the provider

When the surface changes, you get a notification via **Slack or email** so a newly exposed asset never goes unnoticed.

## Exposure scoring

Every asset carries an **ExposureTier** that reflects how reachable and sensitive it is:

| Tier | Meaning |
|------|---------|
| `at-risk` | Sensitive services exposed on public ingress - highest priority |
| `public` | Reachable from the internet |
| `edge` | Fronted by an edge/CDN or gateway layer |
| `private` | Not publicly reachable |

Exposure **escalates** when sensitive services are reachable on public ingress ports, pushing an asset toward the `at-risk` tier so you can triage it first.

## Verified assets and one-click pentests

Assets discovered through an authenticated cloud connection are **cloud-verified**: because you proved ownership by connecting the provider account, TurboPentest trusts them for scanning without a separate DNS check. This complements [DNS TXT domain verification](/docs/getting-started/quick-start) - either path establishes that you own the target.

A verified asset feeds a **one-click pentest**: launch a scan straight from the asset in your inventory, or reference it by `assetId` when starting a pentest via the API.

```bash
curl -X POST https://turbopentest.com/api/pentests \
  -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "assetId": "asset_123",
    "tier": "deep"
  }'
```

## Asset sharing

A verified asset can be **shared with another account**. The receiving account can **accept or decline** the share. This lets teams and partners collaborate on the same attack surface - for example, sharing a verified asset with a security vendor account that runs pentests on your behalf.