☁️ AWS Penetration Testing Checklist for Cloud Security Assessments
A practical checklist for identifying common AWS misconfigurations, privilege escalation paths, exposed assets, logging weaknesses, and cloud security risks during authorized security assessments.
1.Test for Unauthenticated Bucket Access
2.Test for Semi-Public Bucket Access (Improper ACL Permissions)
3. Target and Identify AWS Access Keys Exposed in Git Commits
4.Test for Extracting Keys from an EC2 Instance
5.Assess AWS Security Misconfigurations
6.Test EC2 Instances for Security Weaknesses
7.Evaluate Internal AWS Services Using Lambda-Based Persistence Scenarios
8.Test for Subdomain Takeover Risks
9.Assess AWS IAM Privilege Escalation Paths
10.Test for Remote Code Execution (RCE) Opportunities
11.Perform AWS Role Enumeration (IAM)
12.Test EC2 Service Abuse for Privilege Escalation
13.Assess IAM Enumeration and CloudTrail Logging Weaknesses
14.Check Bitbucket Server Data for AWS Credentials Exposure
15.Evaluate DNS Rebinding Risks in Cloud Environments
16.Assess Local Windows/Linux Log Integrity
17. Review Serverless Actions That Could Add Root Certificates or SSH Keys (AWS Lambda)
18.Test Additional Network Interface or IP Assignment Capabilities on Compromised EC2 Instances
19.Assess VM Snapshots and Storage Backups for Exposed Passwords, Keys, and Certificates
20.Test for OS-Level Access Through AWS Systems Manager (SSM) Privileges
21. Review Systems Manager Commands and EC2 UserData Abuse Scenarios
22.Assess Risks from Passed Roles and Instance Credential Exposure
23.Fingerprint Servers, Frameworks, and Sensitive Data Exposure in Logs
24.Test for CSV Injection in AWS CloudTrail Exports
25.Check for AWS Secrets Accessible Through Instance Metadata
26.Assess Load Balancer Misconfigurations That Could Enable Session Hijacking
27. Review Metadata Exposure on Proxy and HTTP Forwarding Servers
28.Assess Cloud Workload Credential Exposure (AWS STS, Azure Waagent)
29.Evaluate Access to Cloud Key Management Services (AWS KMS, Azure Key Vault)
30.Test Data Manipulation Risks in S3, RDS, and Redshift
31.Assess Business Logic Abuse Through AWS Lambda or Azure Logic Apps
32.Test for Unauthorized Changes in SQL/MySQL Databases
33.Identify Regions Where Logging Is Disabled or Incomplete
34.Assess Log Validation and Log Integrity Weaknesses
35.Test VPC Flow Log Visibility and Monitoring Gaps
36.Evaluate Cloud Alerting Controls (CloudWatch, GuardDuty, Security Hub, Azure Security Center)
37.Assess Data Access Logging Controls for S3, CloudTrail, and Redshift
38. Review Log Retention, Deletion, and Integrity Protection Mechanisms
39.Assess Process Injection, Token Manipulation, and Privilege Abuse Opportunities
40.Test Creation or Reset of High-Privilege User Credentials
41. Review IAM Policy Modification Risks and Default Policy Version Abuse
⚠️ Authorized Testing Only. Unauthorized access or testing is illegal and unethical.