AWS Attack Paths

AWS attacks follow a recognizable playbook: get initial creds (leaked keys, SSRF to IMDS, Lambda env vars), enumerate IAM to map what you can do, escalate privileges via policy misconfigs (iam:PassRole + lambda:InvokeFunction, iam:CreatePolicyVersion), pivot across services. CloudTrail logs everything; GuardDuty patterns the anomalies. This walks the full attack chain with Pacu and aws-cli commands.