AWS Pentest: techniques and attack vectors

AWS Pentest refers to penetration testing conducted against Amazon Web Services infrastructures to identify misconfigurations, excessive permissions, and exploitable attack vectors specific to cloud environments. Unlike traditional network pentests, AWS Pentest focuses on identity and access management (IAM) policies, resource-based permissions, service configurations, and inter-service trust relationships. The AWS shared responsibility model places security configuration firmly on the customer side, making misconfigurations the primary attack surface. Key areas include IAM roles with overly permissive policies, publicly exposed S3 buckets, EC2 instance metadata service (IMDS) abuse, Lambda function misconfigurations, and cross-account trust relationships. Attackers target these elements to achieve initial access, escalate privileges, move laterally across services, and ultimately exfiltrate data or gain persistent administrative control. Understanding the AWS permission model — including resource-based policies, service control policies (SCPs), and permission boundaries — is prerequisite knowledge for any practitioner conducting assessments in cloud-native or hybrid AWS environments.

Detecting malicious activity during an AWS Pentest engagement requires monitoring CloudTrail logs, which record every API call made within an account. Key indicators of compromise include unusual calls to iam:CreateAccessKey, iam:AttachRolePolicy, sts:AssumeRole from unexpected principals, and GetCallerIdentity from unfamiliar IP addresses or user agents. GuardDuty detects anomalies such as credential use from Tor exit nodes, unusual EC2 instance metadata queries, and S3 data exfiltration patterns. Security Hub aggregates findings across services and highlights CIS AWS Foundations Benchmark violations. Defenders should monitor for calls to ec2:DescribeInstances, secretsmanager:GetSecretValue, and ssm:GetParameter in bulk, which indicate enumeration activity. VPC Flow Logs reveal unexpected outbound connections from EC2 instances. Enabling S3 server access logging surfaces unauthorized GetObject requests on sensitive buckets. Alerting on iam:PassRole combined with lambda:CreateFunction is a reliable signal for privilege escalation attempts. Centralizing logs in an immutable S3 bucket with CloudTrail log file validation enabled ensures log integrity during incident investigations.

Red teams conducting an AWS Pentest commonly begin with credential harvesting — targeting exposed .env files, EC2 user data scripts, or SSRF vulnerabilities that reach the IMDSv1 endpoint at 169.254.169.254 to retrieve instance role credentials. Tools such as Pacu (an AWS exploitation framework) automate enumeration of IAM permissions, S3 buckets, Lambda functions, and EC2 snapshots. Privilege escalation paths include iam:PassRole combined with ec2:RunInstances to launch an instance assuming a high-privilege role, or iam:CreatePolicyVersion to overwrite an existing policy with Administrator access. ScoutSuite and Prowler perform automated misconfiguration audits across dozens of AWS services. Lateral movement leverages assumed cross-account roles or compromised SSM sessions into EC2 instances. Persistence is achieved by creating new IAM users, adding access keys to existing roles, or deploying malicious Lambda functions triggered by CloudWatch Events. Counter-measures include enforcing IMDSv2 exclusively (blocking IMDSv1 token-less requests), applying least-privilege IAM policies, enabling AWS Organizations SCPs to restrict dangerous actions account-wide, and conducting regular access reviews with IAM Access Analyzer to detect unintended external resource exposure.