> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/ai/mcp-server/use-cases/security-audit.md). # Security Audit with AI The MCP server reads configuration data across Certificate Manager, IONOS CLOUD Object Storage, Cloud DNS, Billing, and Activity Log: the product areas most relevant to security and compliance checks. {% hint style="info" %} **Note:** All tools are read-only. The MCP server cannot change any configuration; it only reads and reports. This makes it safe to run broad audit queries without risk of accidental changes. {% endhint %} {% hint style="info" %} **Privacy note:** When you run audit prompts, your AI assistant sees resource names, bucket names, certificate metadata, DNS zone names, and billing line items from your space.vars.ionos\_cloud account. Many AI clients do not retain data between sessions by default, but storage and retention policies vary by client and configuration. Check your AI client's privacy settings. If you have compliance requirements around sharing resource names with AI systems, review them in the DCD first or run audits against a sandbox account. {% endhint %} ## Quick health check Not a security expert? Start here. These three prompts run in under a minute and give you a plain-language summary of your account's security posture. They are read-only and safe to run at any time. > Give me a quick security health check of my space.vars.ionos\_cloud account: list any certificates expiring in the next 90 days, check if any Object Storage buckets have public access enabled, and show me any DNS zones without DNSSEC protection. > Do I have any Object Storage buckets without encryption enabled? List them with their names and locations. > List all my DNS zones. For each one, tell me whether DNSSEC is enabled and whether it has any records beyond the SOA. *** **Quick cost check** (not security, but a good complement): > List my five most recent billing invoices and flag any line items that increased by more than 30% compared to the previous invoice. *** ## Advanced audit prompts **Who this is for:** Security engineers, compliance teams, platform engineers, and finance/audit teams who must audit space.vars.ionos\_cloud infrastructure for misconfigurations, expiring credentials, and security posture gaps. ### Tools used in this section | Product area | Tools | | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Certificate Manager | `list_cert_certificates`, `get_cert_certificate`, `list_cert_auto_certificates`, `get_cert_auto_certificate` | | IONOS CLOUD Object Storage | `list_object_storage_buckets`, `get_object_storage_bucket_public_access_block`, `get_object_storage_bucket_policy_status`, `get_object_storage_bucket_encryption`, `get_object_storage_bucket_cors`, `list_object_storage_access_keys` | | Cloud DNS | `list_dns_zones`, `list_dns_zone_dnssec_keys`, `list_dns_records`, `list_dns_secondary_zones`, `get_dns_secondary_zone_axfr`, `list_dns_reverse_records` | | Billing | `list_billing_traffic`, `list_billing_evn`, `get_billing_utilization_daily`, `list_billing_invoices` | | Activity Log | `list_activitylog_contracts`, `list_activitylog_events` | *** ## Certificate Manager: expiry audit Identify certificates approaching expiry before they cause outages. > List all certificates in Certificate Manager. Flag any that expire within 30 days and group them by expiry date. > List all auto-certificates. For each one, show the provider, the domain it covers, and when it expires. Flag any expiring within 60 days. > Show me all certificates that expire in the next 60 days. Sort by expiry date and include the certificate ID and associated provider. ## IONOS CLOUD Object Storage: bucket security audit Check bucket configurations for common security misconfigurations. **Glossary:** *Public access block*: a setting that prevents anyone on the internet from reading your buckets. *Bucket policy*: rules that control who can access objects in a bucket. *CORS* (Cross-Origin Resource Sharing): controls which websites can request data from your bucket. > List all Object Storage buckets. For each one, check the public access block configuration and flag any buckets where public access is not fully blocked. > Check the bucket policy status for all buckets and identify any buckets with public bucket policies. > List all buckets and check their encryption configuration. Flag any buckets that do not have server-side encryption enabled. > For each bucket, retrieve the CORS configuration and flag any buckets that allow requests from all origins (`*`). > List all Object Storage access keys in my account. Show the key ID and creation date for each one. Flag any keys that were created more than 180 days ago; these may be candidates for rotation. ### Combined bucket posture check > Run a full security posture check on all Object Storage buckets: for each bucket, check public access blocks, bucket policy status, encryption, and CORS configuration. Produce a summary table with a pass/fail status for each check per bucket. ## Cloud DNS: zone audit Verify DNS zones are correctly configured and protected. **Glossary:** *DNSSEC*: a security extension that prevents attackers from forging DNS responses. *SOA record*: the Start of Authority record that every valid DNS zone must have. *AXFR*: a zone transfer mechanism that copies DNS records from primary to secondary servers; incomplete transfers can leave secondary zones stale. > List all DNS zones and check which ones have DNSSEC enabled. Flag any zones without DNSSEC keys configured. > List all DNS zones and check for zones that have no records. Flag any zones that contain only an SOA record with no additional A, CNAME, or MX records. > List all secondary zones and check their AXFR transfer status. Identify any secondary zones where zone transfer has not completed successfully. > Show me all reverse DNS records. List each record's IP address and hostname. Flag any where the hostname does not follow your organisation's naming convention. ## Billing: anomaly detection Identify unexpected charges, traffic spikes, and potential unauthorized activity. > Show my billing traffic for the last three billing periods and flag any periods where traffic was more than 50% higher than the previous period. > List all EVN provisioning interval records for this month. Flag any resources that were created and deleted within the same day; these may indicate accidental or unauthorized provisioning. > Retrieve my daily usage for the last 30 days. Identify any days where total spend was more than double the 30-day average. > List all billing invoices for this year. Compare the three most recent invoices and highlight any line items that increased by more than 20%. For deeper cost analysis and FOCUS-compliant reporting, see [FinOps and FOCUS Billing](/cloud/ai/mcp-server/use-cases/finops-focus-billing.md). ## Cross-product audit Combine multiple product areas in a single audit session. > Run a full infrastructure security audit: check certificate expiry (flag anything expiring within 60 days), check all Object Storage buckets for public access and missing encryption, check all DNS zones for missing DNSSEC, check for billing traffic anomalies in the last 30 days, and list any Error events in the activity log for the last 7 days. Produce a prioritised findings report. > List all data centers, servers, volumes, and Object Storage buckets. Group them by location and flag any that have no associated servers or appear to be unused based on their names or descriptions. ## Next steps * [FinOps and FOCUS Billing](/cloud/ai/mcp-server/use-cases/finops-focus-billing.md): deeper cost analysis and standards-compliant billing pipelines * [Tool Reference](/cloud/ai/mcp-server/tool-reference.md): full list of all available tools and their inputs * [Troubleshooting](/cloud/ai/mcp-server/troubleshooting.md): if queries return unexpected errors --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ionos.com/cloud/ai/mcp-server/use-cases/security-audit.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.