Before performing a vulnerability assessment on a cloud service, the cloud service provider (CSP) must be notified. Managing Cloud principles explain that CSPs own and operate the underlying infrastructure and define acceptable use and security testing conditions through their terms of service.
Notifying the CSP ensures that testing activities are authorized and do not violate contractual agreements or trigger security alerts. Unauthorized testing could be mistaken for malicious activity and lead to service disruption or legal consequences. CSP notification also allows coordination to minimize operational impact.
Although the service was procured through a broker, the CSP ultimately controls the environment being tested. Therefore, the cloud service provider is the correct entity to notify.