Thanks, that's a perfect suggestion! I'm accustomed to writing automated unit and integration tests for my code. What sort of tests should I add to the provis

Thanks, that's a perfect suggestion! I'm accustomed to writing automated unit and integration tests for my code. What sort of tests should I add to the provisioning routine to prove that I got it right? I appreciate that a skilled pentester would likely uncover service-specific or instance-specific vulnerabilities, but there are surely some testing principles that would make sense for every single server. Or is it really that at a high level, a port scan suffices and from there everything is service-specific (or at least requires going through a port)? I don't know what I don't know, here. Is there any way that a machine can be vulnerable from a network connection except through a port? (Let's ignore attacks which require physical access for the time being.)