pentest-cloud

name

pentest-cloud

description

AWS, Azure/Entra ID, and GCP penetration testing. Use when the user mentions AWS pentest, Azure pentest, GCP pentest, IAM privilege escalation, S3 misconfig, IMDSv1/v2 SSRF, managed identity abuse, ScoutSuite, Prowler, Pacu, CloudFox, ROADtools, AzureHound, MicroBurst, AADInternals, Workload Identity, OIDC trust, federated credentials, cross-account / cross-tenant chains, KMS, Lambda, Cognito, App Service, Storage Account, Key Vault, GKE/EKS/AKS, GitHub Actions OIDC trust, Terraform state, or any cloud bucket / IAM enumeration task.

Pentest — Cloud (AWS / Azure / GCP)

Apply 06-cloud/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 06-cloud/00-overview.md first.

Phase order

AWS

1. 06-cloud/01-aws-recon.md — accounts, IAM inventory, public exposure, IMDS, defensive posture.
2. 06-cloud/02-aws-iam-privesc.md — 30+ documented primitives.
3. 06-cloud/03-aws-services.md — S3, EC2/SSM/IMDS, Lambda, RDS, KMS, Secrets, Cognito, API GW, ECS/EKS.

Azure / Entra ID

4. 06-cloud/04-azure-recon.md — tenant / sub / MG inventory, CA policies, AAD Connect.
5. 06-cloud/05-azure-entra-id.md — app registrations, managed identities, PIM, Conditional Access bypass, PRT theft.
6. 06-cloud/06-azure-services.md — Storage, VMs, AKS, Key Vault, App Service, Logic Apps.

GCP

7. 06-cloud/07-gcp-recon.md — org / folder / project hierarchy, IAM, Workload Identity.
8. 06-cloud/08-gcp-iam-privesc.md — impersonation chains, service-account abuse.
9. 06-cloud/09-gcp-services.md — GCS, GCE, Cloud Functions, Cloud Run, GKE, IAP, Cloud SQL.

Multi-cloud

10. 06-cloud/10-multicloud-cicd.md — GitHub Actions / GitLab / Bitbucket OIDC trust, Terraform state, IaC scanning, container registry abuse.

How to operate

1. Run a multi-cloud auditor first (Prowler / ScoutSuite / CloudFox) to baseline IAM + public exposure before targeted privesc.
2. Privesc: walk the documented primitive catalog in 02-aws-iam-privesc.md, 05-azure-entra-id.md, 08-gcp-iam-privesc.md against the discovered identity surface.
3. CI/CD trust is the most common cross-org pivot — always check OIDC sub claim conditions in trust policies (10-multicloud-cicd.md).
4. Generate findings via templates/finding-template.md and cross-reference frameworks/cis-benchmarks.md and frameworks/csa-ccm.md.
5. Hybrid identity (on-prem AD ↔ Entra ID): also pull pentest-active-directory/12-azure-ad-hybrid.md.

When NOT to use

• On-prem AD only → pentest-active-directory.
• Generic web app hosted in cloud (without cloud-layer findings) → pentest-web-api.

Pre-conditions

• Reader/Auditor IAM credentials in account/tenant/project.
• ROE clarity on cloud-provider acceptable testing (AWS self-attest, Azure RoE, GCP customer-perspective).
• Prowler, ScoutSuite, Pacu, CloudFox, ROADtools, AzureHound, gcphound installed.

OPSEC

• CloudTrail / Activity Logs / Audit Logs visible by default.
• Privesc primitives often trigger GuardDuty / Defender for Cloud alerts.
• Stolen IAM keys often have rotation requirements — coordinate use.

References inside the library

• Cheatsheets: cheatsheets/cloud-aws.md, cheatsheets/cloud-azure.md.
• Tooling: tools/install-cloud.md, tool-mappings/06-cloud-tools.md.
• Frameworks: frameworks/cis-benchmarks.md, frameworks/csa-ccm.md.
• Playbook: playbooks/04-cloudgoat-walkthrough.md.