Vulnerability Scan servers hosted on cloud

If we talk about a webserver hosted on a cloud:

I would say you should scan the domain (company.org) from a scanner which is "outside" and has a public ip. And one authenticated scan from a scanner inside the cloud.

But i am not sure about this. Would you add something to this? Am i just scanning the CDN or Loadbalancer of the cloud service (i hope not)? Is just an authenticated scan enough or is a scan from outside …

cdn cloud cloud service cybersecurity domain hope org public scan scanner scanning servers service vulnerability vulnerability scan webserver