| name | cloud-security |
| description | Use when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuse |
| metadata | {"type":"offensive","phase":"exploitation","tools":"pacu, cloudfox, scoutsuite, prowler, trivy, kubectl, aws-cli, az-cli, gcloud, peirates, mkat, azurehound, roadtools, stratus-red-team, kube-bench","mitre":["T1078.004","T1552.005","T1098.001","T1528","T1611","T1548"]} |
| kill_chain | {"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0004","TA0008","TA0006"],"attck_techniques":["T1078.004","T1552.005","T1552.007","T1098.001","T1098.003","T1528","T1606.002","T1611","T1610","T1134.001","T1548","T1538"]} |
| depends_on | ["recon-osint"] |
| feeds_into | ["exploit-development","active-directory-attack","advanced-redteam"] |
| inputs | ["cloud_config","iam_policies","kubeconfig","ci_cd_config"] |
| outputs | ["cloud_misconfig_list","finding_record","attack_path","stolen_credentials"] |
| references | ["references/aws-iam-privesc.md","references/imds-metadata-ssrf.md","references/azure-entra-attacks.md","references/gcp-attacks.md","references/kubernetes-container-escape.md","references/iac-secrets-ci-cd.md"] |
| scripts | ["scripts/aws_privesc_enum.py","scripts/imds_harvester.py","scripts/entra_device_code_phish.py","scripts/gcp_impersonation_mapper.py","scripts/k8s_can_i_abuse.py","scripts/oidc_trust_auditor.py"] |
