Cloud Pentest

---
name: cloud-pentest
description: "Use when testing cloud environments (AWS, Azure, GCP) for security weaknesses — IAM misconfiguration and privilege escalation, exposed storage/secrets, public/misconfigured services, SSRF-to-metadata credential theft, serverless and container-service risks, logging gaps, and lateral movement across accounts/subscriptions/projects. Maps to MITRE ATT&CK Cloud and provider benchmarks. Authorized engagements only."
---

# Cloud Penetration Testing (AWS / Azure / GCP)

Assessment of cloud infrastructure and IAM. Cloud compromise is usually an **identity/misconfiguration** problem, not a memory-corruption one. Mapped to **MITRE ATT&CK (Cloud matrices)** and provider security benchmarks (CIS).

## 0. Authorization gate
- [ ] Written authorization from the account/subscription/project owner.
- [ ] Provider testing policy respected (most permit customer-owned testing; some services need notice).
- [ ] Scope: which accounts/subscriptions/projects and services; excluded prod data.

## 1. Recon & enumeration
- Enumerate the identity you're given: permissions, roles, attached policies, assumable roles.
- Inventory resources: compute, storage, databases, functions, networking, key/secret stores.
- Find public exposure: open storage buckets/blobs, public snapshots/images, exposed databases, public endpoints.

## 2. IAM misconfiguration & privilege escalation (the core)
- Over-permissive policies, wildcard permissions, dangerous permission combinations (e.g., pass-role + create-function, policy-version manipulation, privilege-granting APIs).
- Assume-role chains and cross-account trust that widen access.
- **Fix:** least privilege, remove wildcards, guardrails/SCPs, permission-boundary review, no long-lived keys.

## 3. Secrets & credential exposure
- Secrets in instance metadata, environment variables, code, storage, or CI; long-lived access keys.
- **SSRF → metadata service** to steal instance credentials (coordinate with `web-app-pentest`/`api-security-audit`).
- **Fix:** enforce IMDSv2/metadata hardening, use short-lived workload identity, secret managers, rotate keys.

## 4. Service-specific
- **Storage:** public/misconfigured buckets, overly broad ACLs, unencrypted data.
- **Serverless:** function role over-permission, event-injection, dependency risk.
- **Containers/K8s services:** route to `container-k8s-pentest`.
- **Databases/queues:** exposure, weak auth, public access.

## 5. Lateral movement & persistence (document)
Cross-account role assumption, new credentials/keys, backdoor IAM principals, snapshot/data exfil paths — prove and document, don't persist.
- **Fix:** monitor IAM changes, detective controls (CloudTrail/Activity logs/Audit logs), anomaly alerting.

## 6. Logging & detection review
Verify audit logging is on and centralized; identify blind spots. Cloud attacks are very detectable *if* logging exists.

## 7. Tooling
Provider CLIs, ScoutSuite/Prowler (posture), pmapper/cloudsplaining (IAM analysis), pacu (AWS), ROADtools (Azure → also `entra-cloud-pentest`). Follow RoE + provider policy.

## 8. Reporting
Present IAM/misconfig attack paths, blast radius per finding, and least-privilege remediation. Checklist: `references/cloud-checklist.md`.

---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>