AWS Penetration Testing 101

Understanding the Shared Responsibility Model in Cloud Security

The shared responsibility model is a crucial concept in cloud security. It defines the security responsibilities of the cloud provider (AWS) and the customer. Understanding this model is essential for securing cloud infrastructure and performing security assessments.

Security in the Cloud vs. Security of the Cloud

• Security in the Cloud: The customer is responsible for securing their workloads, including:
  • Configuring EC2 instances and reviewing security policies
  • Managing S3 bucket permissions and encryption
  • Implementing proper IAM policies
• Security of the Cloud: AWS is responsible for securing the underlying infrastructure, including:
  • Physical security of data centers
  • Availability and management of AWS services
  • Securing the virtualization layer

Kubernetes Security Responsibilities

When using Kubernetes in AWS (EKS), responsibilities are divided:

• AWS Responsibilities:
  • Managing and securing the Kubernetes control plane
  • Ensuring high availability and security of cluster infrastructure
• Customer Responsibilities:
  • Securing worker nodes and updating firewall policies
  • Configuring IAM roles and network security settings

Questions to Ask Before Starting a Cloud Pentest

Before beginning a penetration test in AWS, it’s essential to gather critical information about the environment:

• How many AWS services are in use?
• What IAM policies are configured, and are there any misconfigurations?
• How many AWS accounts exist, and are they interconnected?
• How is the application utilizing AWS services?
• Is the service externally exposed? (e.g., open S3 buckets, DynamoDB with weak credentials)
• Is the service managed by AWS or the customer?

Identifying the Proper Attack Surface

A key part of cloud security testing is understanding how applications interact with AWS services. Security researchers should ask:

• What services are exposed to the internet?
• Are there weak access controls on S3 buckets, EBS snapshots, or AMI images?
• Are there vulnerabilities in IAM roles and permissions?

External Reconnaissance

Reconnaissance is critical for identifying security weaknesses in AWS environments:

• Searching AWS Marketplace for account IDs linked to the target organization
• Brute-forcing account IDs with AWS sign-in URLs (https://<account_id>.signin.aws.amazon.com)
• Searching publicly available EBS snapshots and AMI images for sensitive data

Local Filesystem Testing

Cloud pentesters should examine local system configurations for sensitive credentials:

• Checking config files and environment variables for hardcoded secrets
• Reviewing AWS CLI credentials stored in the home directory

Privilege Escalation in AWS

Privilege escalation techniques can be used to pivot across AWS services:

• Extracting AWS credentials from application files or system logs
• Connecting to the metadata endpoint on EC2 instances (http://169.254.169.254/latest/meta-data/)
• Using misconfigured IAM roles to gain additional privileges

AWS Security Tokens and Enumeration

AWS Security Tokens provide temporary access to AWS services. Attackers can leverage them to escalate privileges:

• Enumerating IAM permissions:
  • Using aws sts get-caller-identity to verify IAM credentials
  • Automating IAM permission enumeration with enumerate-iam
• Escalating privileges:
  • Identifying misconfigured IAM roles that allow privilege escalation
  • Using AWS Lambda or EC2 roles to access sensitive resources

Conclusion

Understanding the shared responsibility model and performing thorough reconnaissance are crucial for cloud security assessments. By following a structured approach—identifying the attack surface, enumerating permissions, and exploiting misconfigurations—security professionals can enhance AWS security and mitigate potential risks.