Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited. Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: 1. Ask the user to state the exact target URL, IP, account, or resource. 2. Ask the user to confirm written authorization and the permitted scope. 3. Show the exact command(s) and explain their expected effect. 4. Wait for explicit confirmation in the current conversation. Without that confirmation, remain read only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments. AWS Penetration Testing Purpose Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations. Inputs/Prerequisites AWS CLI configured with credentials Valid AWS credentials (even low privilege) Understanding of AWS IAM model Python 3, boto3 library Tools: Pacu, Prowler, ScoutSuite, SkyArk Outputs/Deliverables IAM privilege escalation paths Extracted credentials and secrets Compromised EC2/Lambda/S3 resources Persistence mechanisms Security audit findings Essential Tools Tool Purpose Installation Pacu AWS exploitation framework git clone https://github.com/RhinoSecurityLabs/pacu SkyArk Shadow Admin discovery Import Module .\SkyArk.ps1 Prowler Security auditing pip install prowler ScoutSuite Multi cloud auditing pip install scoutsuite enumerate iam Permission enumeration git clone https://github.com/andresriancho/enumerate iam Principal Mapper IAM analysis pip install principalmapper Core Workflow Step 1: Initial Enumeration Identify the compromised identity and permissions: Step 2: IAM Enumeration Step 3: Metadata SSRF (EC2) Exploit SSRF to access metadata endpoint (IMDSv1): For IMDSv2 (token required): Fargate Container Credentials: Privilege Escalation Techniques Shadow Admin Permissions These permissions are equivalent to administrator: Permission Exploitation iam:CreateAccessKey Create keys for admin user iam:CreateLoginProfile Set password for any user iam:AttachUserPolicy Attach admin policy to self iam:PutUserPolicy Add inline admin policy iam:AddUserToGroup Add self to admin group iam:PassRole + ec2:RunInstances Launch EC2 with admin role lambda:UpdateFunctionCode Inject code into Lambda Create Access Key for Another User Attach Admin Policy Add Inline Admin Policy Lambda Privilege Escalation S3 Bucket Exploitation Bucket Discovery Bucket Enumeration Public Bucket Search Lambda Exploitation SSM Command Execution Systems Manager allows command execution on EC2 instances: EC2 Exploitation Mount EBS Volume Shadow Copy Attack (Windows DC) Console Access from API Keys Convert CLI credentials to console access: Covering Tracks Disable CloudTrail Note: Kali/Parrot/Pentoo Linux triggers GuardDuty alerts based on user agent. Use Pacu which modifies the user agent. Quick Reference Task Command Get identity aws sts get caller identity List users aws iam list users List roles aws iam list roles List buckets aws s3 ls List EC2 aws ec2 describe instances List Lambda aws lambda list functions Get metadata curl http://169.254.169.254/latest/meta data/ Constraints Must: Obtain written authorization before testing Document all actions for audit trail Test in scope resources only Must Not: Modify production data without approval Leave persistent backdoors without documentation Disable security controls permanently Should: Check for IMDSv2 before attempting metadata attacks Enumerate thoroughly before exploitation Clean up test resources after engagement Examples Example 1: SSRF to Admin Troubleshooting Issue Solution Access Denied on all commands Enumerate permissions with enumerate iam Metadata endpoint blocked Check for IMDSv2, try container metadata GuardDuty alerts Use Pacu with custom user agent Expired credentials Re fetch from metadata (temp creds rotate) CloudTrail logging actions Consider disable or log obfuscation Additional Resources For advanced techniques including Lambda/API Gateway exploitation, Secrets Manager & KMS, Container security (ECS/EKS/ECR), RDS/DynamoDB exploitation, VPC lateral movement, and security checklists, see [references/advanced aws pentesting.md](references/advanced aws pentesting.md). When to Use This skill is applicable to execute the workflow or actions described in the overview.

aws-penetration-testing