| name | performing-cloud-penetration-testing |
| description | Performs authorized penetration testing of cloud environments across AWS, Azure, and GCP to identify IAM misconfigurations, exposed storage buckets, overly permissive security groups, serverless function vulnerabilities, and cloud-specific attack paths from initial access to account compromise. The tester uses cloud-native tools and specialized frameworks like Pacu and ScoutSuite to enumerate and exploit cloud infrastructure. Activates for requests involving cloud pentest, AWS security assessment, Azure penetration testing, or cloud infrastructure security testing.
|
| domain | cybersecurity |
| subdomain | penetration-testing |
| tags | ["cloud-pentest","AWS-security","Azure-security","IAM-exploitation","cloud-infrastructure"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
Performing Cloud Penetration Testing
When to Use
- Assessing the security posture of cloud infrastructure before or after migration from on-premises
- Testing IAM policies, security groups, and network ACLs for overly permissive configurations
- Evaluating the security of serverless architectures (Lambda, Azure Functions, Cloud Functions)
- Identifying exposed cloud storage (S3 buckets, Azure Blob containers, GCS buckets) containing sensitive data
- Testing the effectiveness of cloud security controls (GuardDuty, Defender for Cloud, Security Command Center)
Do not use without both written authorization from the cloud account owner AND compliance with the cloud provider's penetration testing policy (AWS requires no prior approval for most services; Azure and GCP require notification or approval for certain test types).
Prerequisites
- Written authorization specifying target cloud accounts, regions, and services in scope
- Compliance with cloud provider penetration testing policies (AWS Penetration Testing Policy, Azure Penetration Testing Rules, GCP Acceptable Use Policy)
- Cloud credentials at various privilege levels (read-only, developer, admin) for testing authorization boundaries
- Pacu (AWS), PowerZure (Azure), or GCP-specific exploitation frameworks installed
- ScoutSuite or Prowler for automated cloud security posture assessment
- AWS CLI, Azure CLI, and/or gcloud CLI configured with test credentials
Workflow
Step 1: Cloud Reconnaissance and Enumeration
Enumerate the cloud environment to map the attack surface:
AWS Enumeration:
aws sts get-caller-identity - Verify current identity and accountaws iam list-users - List all IAM usersaws iam list-roles - List all IAM roles and their trust policiesaws s3 ls - List all S3 bucketsaws ec2 describe-instances --region us-east-1 - List EC2 instancesaws lambda list-functions - List Lambda functionsaws rds describe-db-instances - List RDS databases- Use Pacu for automated enumeration:
run iam__enum_permissions, run iam__enum_users_roles_policies_groups
Azure Enumeration:
az account list - List subscriptionsaz ad user list - List Azure AD users
