Advanced Offensive Security

Cloud Pentesting (AWS / Azure / GCP)

IAM misconfig, exposed storage, metadata SSRF, and privilege escalation in the cloud.

Advanced · 17 min

Open the interactive lesson →

Infrastructure has moved to the cloud, and so have the vulnerabilities. Cloud pentesting focuses on identity (IAM), storage exposure, and service misconfiguration rather than traditional OS exploits.

Common cloud findings

• Public storage buckets — world-readable S3/Blob/GCS holding sensitive data.
• Over-privileged IAM roles/keys — leaked keys with far more access than needed.
• IAM privilege escalation — chaining permissions (e.g. iam:PassRole, lambda) to admin.
• Metadata SSRF (169.254.169.254) — steal temporary role credentials from a compromised app.
• Exposed secrets in code, CI/CD, and environment variables.

# Enumerate what leaked AWS keys can do
aws sts get-caller-identity
aws s3 ls
# Automated cloud recon / privesc
scoutsuite aws        # posture assessment
pacu                  # AWS exploitation framework
prowler               # security checks

Take the quiz →