🔴 Cloud Pentest
Cloud Penetration Testing Checklist
Structured methodology for AWS, Azure, and GCP cloud pentests — enumeration, IAM, network, storage, compute, tools, and report template.
⚠️ Cloud penetration testing requires explicit written authorisation from the account owner AND compliance with the cloud provider's penetration testing policies. AWS, Azure, and GCP each have specific rules — check before testing.
📋 Pre-Engagement Requirements
Written authorisation obtained Mandatory
Signed statement from account owner listing account IDs, regions, and services in scope.
Cloud provider notification (if required) Mandatory
AWS: no pre-approval needed but must follow Acceptable Use Policy. Azure: no approval needed within own tenant. GCP: no approval needed within own org.
Scope document finalised Mandatory
Account IDs, subscription IDs, project IDs in scope. Services included/excluded. Regions in scope.
Rules of engagement agreed Mandatory
Allowed testing hours. Escalation contacts. What to do if real incident found. Data handling for findings.
Test account credentials provided Mandatory
Minimum: read-only credentials for external assessment. Full scope credentials for internal assessment.
Out-of-scope systems identified Mandatory
List all accounts, services, and regions explicitly excluded. Production impact minimisation plan.
Baseline snapshot taken Recommended
Record current state — active instances, security groups, IAM users — before testing begins.
CERT-In empanelled status verified (for Indian engagements) If regulated
For formal VAPT under Indian regulatory requirements, tester must be CERT-In empanelled.
🛠️ Cloud Provider Pentest Policies
| Provider | Pre-approval Needed? | Key Restrictions | Policy URL |
|---|---|---|---|
| AWS | No pre-approval | No DDoS testing, no DNS zone walking, no testing of AWS infrastructure itself. Must follow Customer Support Policy. | aws.amazon.com/security/penetration-testing |
| Azure | No pre-approval | Must follow Microsoft Cloud Penetration Testing Rules of Engagement. No social engineering of Microsoft staff. | microsoft.com/en-us/msrc/pentest-rules-of-engagement |
| GCP | No pre-approval | Must be within your own GCP organisation. No testing of Google's shared infrastructure. | cloud.google.com/terms/aup |
🔍 Cloud Asset Enumeration
Identify caller identity ScoutSuite
Confirm which credentials you have and what account/tenant/project they belong to.
aws sts get-caller-identity / az account show / gcloud auth list
Enumerate IAM users and roles Pacu, ScoutSuite
List all IAM users, roles, groups, and their attached policies.
aws iam list-users; aws iam list-roles
Enumerate EC2 instances (all regions) ScoutSuite
List all instances, their security groups, and public IPs.
aws ec2 describe-instances --region ap-south-1
Enumerate S3 buckets and access settings ScoutSuite, Prowler
List buckets, check public access settings, enumerate contents.
aws s3 ls; aws s3api get-bucket-acl --bucket NAME
Enumerate security groups for open ingress Prowler
Find all security groups with 0.0.0.0/0 inbound rules.
aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0
Enumerate RDS instances and public access ScoutSuite
Check for publicly accessible databases.
aws rds describe-db-instances --query "DBInstances[?PubliclyAccessible]"
Enumerate Lambda functions and their roles ScoutSuite
List Lambda functions and their execution roles.
aws lambda list-functions
Enumerate CloudTrail configuration Prowler
Check if logging is enabled and if logs are going somewhere useful.
aws cloudtrail describe-trails; aws cloudtrail get-trail-status --name NAME
Enumerate Secrets Manager and SSM parameters Pacu
List available secrets and parameters (not read them yet).
aws secretsmanager list-secrets; aws ssm describe-parameters
Enumerate EKS clusters and node groups ScoutSuite
List Kubernetes clusters and their configurations.
aws eks list-clusters; aws eks describe-cluster --name NAME
Run automated enumeration tool ScoutSuite, Prowler
Use ScoutSuite or Prowler for comprehensive automated enumeration.
scout aws --profile pentest-profile
🔐 IAM Privilege Testing
Test what current credentials can do Pacu
Use aws iam simulate-principal-policy or cloud-specific tools to map allowed actions.
Check for wildcard permissions on attached policies Manual + ScoutSuite
Extract and analyse all policies attached to the test user/role.
Test iam:PassRole escalation paths Pacu (privesc module)
Identify roles that can be passed + services that accept them.
Check for inline policies Pacu
Inline policies are often overlooked — list them for all users, roles, groups.
Test cross-account role assumption ScoutSuite
List and attempt to assume roles with * in trust policy.
Check for password policy weaknesses Prowler
Evaluate IAM account password policy — minimum length, complexity, rotation.
Test access key age and usage Prowler
Find old unused access keys — often higher privilege than expected.
Check for unused IAM permissions AWS IAM Console
Use Access Advisor to find permissions granted but never used.
Test for SSRF → IMDS credential theft Manual
If web app is in scope, test for SSRF to 169.254.169.254.
Run Pacu IAM privilege escalation module Pacu
Automated identification of escalation paths.
🌐 Network & Compute Testing
Port scan all public IPs Nmap, Masscan
Map attack surface — find unexpected open services.
Test SSH/RDP with default or weak credentials Hydra (within scope)
Attempt login with common credentials on exposed management ports.
Verify security group rules vs actual exposure Nmap
Compare AWS security group config to what is actually reachable.
Test EC2 user data for hardcoded secrets Manual (from instance)
Read user data from instance metadata — often contains sensitive config.
Check IMDSv1 availability Manual
Test if IMDS v1 is accessible without token header.
Test for container escape paths kube-hunter
If K8s/ECS in scope — test for privileged containers, hostPath mounts.
Enumerate VPC peering connections ScoutSuite
Identify unexpected network access between accounts or VPCs.
Test Lambda function endpoints Burp Suite
If Lambda exposed via API Gateway, test for injection and logic flaws.
🗄️ Data & Storage Testing
Check S3 buckets for public access S3Scanner, GrayhatWarfare
Attempt anonymous access to all discovered buckets.
Test bucket permissive policies Manual
Check if authenticated-but-not-owner access works.
Look for sensitive data in accessible buckets Manual
Search for credentials, PII, config files in accessible S3 content.
Test Secrets Manager access Pacu
Attempt to read secrets with current credentials.
Check for tfstate files in S3 Manual
Terraform state files contain all resource details and sometimes credentials.
Test RDS connectivity Manual
If RDS has public access, attempt connection with default/common credentials.
Check EBS snapshot sharing Manual
Look for publicly shared EBS snapshots from the account.
Test Key Vault/KMS access Manual
Attempt to use KMS keys for decryption beyond your intended scope.
🛠️ Cloud Pentest Tool Reference
| Tool | Cloud(s) | Purpose | Install |
|---|---|---|---|
| ScoutSuite | AWS, Azure, GCP | Comprehensive cloud environment auditing — generates HTML report of findings across all services. | pip install scoutsuite |
| Prowler | AWS, Azure, GCP | CIS benchmark + security checks — 300+ checks with remediation guidance. CERT-In relevant. | pip install prowler |
| Pacu | AWS | AWS exploitation framework — IAM privilege escalation, persistence, lateral movement modules. | git clone https://github.com/RhinoSecurityLabs/pacu |
| ROADtools | Azure | Azure AD exploration and attack toolkit — enumerate users, groups, apps, conditional access. | pip install roadtools |
| AADInternals | Azure | Azure AD and Microsoft 365 attack/research toolkit. | Install-Module AADInternals (PowerShell) |
| CloudFox | AWS, Azure, GCP | Find privilege escalation paths, secrets, network exposure across cloud environments. | brew install cloudfox |
| GCPBucketBrute | GCP | Enumerate GCP storage buckets — find open or accessible buckets. | python3 GCPBucketBrute.py |
| S3Scanner | AWS | Scan for open S3 buckets — no credentials needed for public bucket detection. | pip install s3scanner |
| cloudmapper | AWS | Visualise AWS network topology — identify exposed services and network paths. | pip install cloudmapper |
| Steampipe | AWS, Azure, GCP | SQL queries against cloud APIs — enumerate and analyse configuration at scale. | brew install steampipe |
| PACU | AWS | Modular AWS attack framework by Rhino Security — best for IAM escalation testing. | pip3 install -r requirements.txt |
| truffleHog | All | Secret scanning — find leaked credentials in code, CI/CD pipelines, environment. | pip install trufflehog |