---
name: aws-cloud-pentesting
description: AWS offensive testing — account and principal identification, IAM enumeration, resource discovery across all regions (S3, EC2, ECS, Lambda, API Gateway, Secrets Manager, SSM, KMS, ECR, snapshots, Cognito, CloudFormation), with AWS CLI as the baseline and Pacu/CloudFox/ScoutSuite as optional accelerators
intent: offensive
assessment_mode:
  - blackbox
  - credentialed
provider:
  - aws
---

# AWS Cloud Pentesting

## Purpose
Full AWS offensive methodology: from an identified AWS account/principal to mapped permissions, discovered resources, exposed data, and escalation/impact paths. Works black-box (via discovery chains) and credentialed (operator-supplied or discovered credentials).

## Entry Conditions
- Black-box: account IDs/bucket names/regions from `cloud-attack-surface-discovery` or an SSRF→metadata chain
- Credentialed: validated credentials from `cloud-credential-abuse` (`aws sts get-caller-identity` already recorded)

## Discovery Signals
- 12-digit account IDs (presigned URLs, S3 ARNs, Lambda invocation error leaks)
- Bucket names, API Gateway IDs, Cognito pool IDs in client-side code
- Region hints from endpoint hostnames

## Attack Model

```text
identity/context established
→ permission enumeration (watch AccessDenied GAPS — they hide paths)
→ resource discovery across ALL regions
→ data exposure + credential harvesting
→ escalation candidates
→ verified impact
```

## Methodology

### Step 1: Identity and Boundaries
```bash
aws sts get-caller-identity
# user vs assumed-role; root keys: enumerate only, never destructive actions
aws iam list-attached-user-policies --user-name <u>
aws iam list-user-policies --user-name <u>          # inline
aws iam get-account-summary                          # global account posture hints
aws iam simulate-principal-policy --policy-source-arn <arn> --action-names "*"
```

### Step 2: All-Region Resource Discovery
IAM, S3, and Secrets Manager naming are global; most everything else is regional. Region-scoped enumeration silently misses us-west-2/eu-* resources:
```bash
for r in us-east-1 us-east-2 us-west-1 us-west-2 eu-west-1 eu-central-1 ap-southeast-1 ap-southeast-2 ap-northeast-1 sa-east-1; do
  export AWS_DEFAULT_REGION=$r
  aws ec2 describe-instances --query "Reservations[].Instances[].InstanceId" --output text 2>/dev/null
  aws lambda list-functions --query "Functions[].FunctionName" --output text 2>/dev/null
  aws ecs list-clusters --output text 2>/dev/null
done
aws s3api list-buckets                                # global
aws secretsmanager list-secrets                       # global
aws ssm describe-parameters                           # global
aws ecr describe-repositories --region us-east-1
```

### Step 3: Deep Enumeration on Findings
- Lambda: `get-function-configuration` (env vars, handler, role), download the deployment package (`aws lambda get-function` → Code Location URL) when scope permits — packages routinely contain `.env` files and hardcoded keys
- ECS: task definitions carry env vars/secrets and task-role ARNs
- EC2: `describe-instances` (instance profiles, user-data), security groups, snapshots
- Secrets Manager/SSM: names → `cloud-secrets-data-access`
- KMS: key policies (`get-key-policy`) as trust surfaces → `cloud-cross-account-tenant-trust`
- Cognito: user pool configurations, app clients, identity pools (client IDs are in frontend JS)
- CloudFormation: `describe-stacks` reveals parameters (often secrets in plain `ParameterValue` if NoEcho was forgotten)
- Snapshots/AMIs: public or shared-with-account exposures (`describe-snapshots --restorable-by-user-ids all` from credentialed context)

### Step 4: Resource-Based Policies
S3/KMS/SNS/SQS/ECR/Lambda resource policies grant access identity policies never show:
```bash
aws s3api get-bucket-policy --bucket <b>
aws ecr get-repository-policy --repository-name <r>
aws kms get-key-policy --key-id <k> --policy-name default
```

### Step 5: Chain
- Escalation candidates → `aws-iam-privilege-escalation`
- Storage exposure → `cloud-storage-exposure-testing`
- Secrets → `cloud-secrets-data-access`
- Trust edges → `cloud-cross-account-tenant-trust`
- EKS boundary → `container-security` for internals, IRSA/node roles here

## Tool Policy
AWS CLI + Python are the baseline. Optional accelerators:
- Pacu: `iam__enum_permissions` (complete first — privesc_scan reasons only over collected permissions; watch for AccessDenied on `iam:GetAccountAuthorizationDetails` which silently degrades results), `set_regions all`, then `iam__privesc_scan`, `lambda__enum` (env vars), `ssm__download_parameters`, `secretsmanager__enum`, `ebs__enum_snapshots_unauth`
- CloudFox: `aws permissions`, `env-vars`, `whoami` — fast blast-radius and permission listing
- ScoutSuite: credentialed posture sweep — grep the run log for AccessDenied before trusting "clean" results
- All tool output is HYPOTHESIS, not proof — see Evidence Contract

## Evidence Contract

```text
candidate resource/permission (tool output or list call)
→ effective-access check (actual GET/read or simulate-principal-policy)
→ concrete data retrieved / action performed
→ report
```

**NOT evidence**: Pacu/ScoutSuite/Prowler findings without live reproduction, a 200 from a create-style call with no read-back, silent clean runs (permission gaps), a list-only view of resources with no access demonstrated

## Common Misses
- AccessDenied gaps during enumeration treated as "no resources" instead of "uncollected"
- Single-region enumeration
- Deployment packages/layers never downloaded for embedded secrets
- Resource-based policies never read (identity-side-only view)
- CloudFormation parameters and ECS task definitions skipped as secret sources
- Cognito misconfigurations (insecure app-client flows, identity-pool role mappings)

## False Positives / Non-Findings
- Resources in another account merely named similarly
- Empty/default services (a VPC with nothing in it)
- Permission gaps reported as "secure" posture

## Xalgorix Tool Strategy
- `terminal_execute` with the AWS CLI (always available)
- Pacu/CloudFox optional; every finding reproduced with raw CLI calls
- Ledger: account, principal, permissions map, resources with verified states

## Specialist Handoffs
`aws-iam-privilege-escalation`, `cloud-secrets-data-access`, `cloud-storage-exposure-testing`, `cloud-cross-account-tenant-trust`, `serverless-cloud-security`, `cloud-metadata-workload-identity` (SSRF chains)

## Stopping Rule
Stop when: caller identity and effective permissions are mapped, all-region resource discovery has completed (or all AccessDenied gaps are recorded), high-value secrets/data have been chased, and the strongest escalation candidates are verified or ruled out. Depth-first on live credentials and data over breadth-first listing.