AWS - common misconfigurations
| Misconfiguration | Risk | What to look for |
|---|---|---|
| Public S3 buckets | high | Bucket policy or ACL allows * or anonymous access |
IAM *:* policies | high | Wildcard actions/resources, esp. on iam:*, s3:* |
| Open security groups (0.0.0.0/0) | high | SSH/RDP/DB ports exposed to the internet |
| EC2 IMDSv1 | high | SSRF can steal IAM creds from instance metadata |
| CloudTrail not enabled or partial | medium | Missing logs, no multi-region trail, no log file validation |
| Access keys for IAM users (vs roles) | medium | Long-lived keys in code, .env files, git history |
| Lambda functions with overly broad roles | medium | Inline policies granting admin or service-wide access |
Common tools
| Tool | Purpose |
|---|---|
| pacu | AWS exploitation framework (offensive) |
| prowler | AWS security posture assessment (defensive) |
| scoutsuite | Multi-cloud security auditing |
| enumerate-iam | Enumerate IAM permissions for a set of keys |
| AWSBucketDump | Enumerate "interesting" files in public S3 buckets |
Useful commands
# whoami
aws sts get-caller-identity
# list your S3 buckets
aws s3 ls
# check if a specific bucket is public
aws s3api get-bucket-policy --bucket NAME --no-sign-request
# enumerate IAM users / roles
aws iam list-users
aws iam list-roles
# check for security groups with 0.0.0.0/0 open to SSH/RDP
aws ec2 describe-security-groups \
--filters Name=ip-permission.cidr,Values=0.0.0.0/0 \
--query 'SecurityGroups[*].[GroupId,GroupName,IpPermissions]'
# list EC2 instances and their IMDSv2 status
aws ec2 describe-instances \
--query 'Reservations[].Instances[].[InstanceId,State.Name,MetadataOptions.HttpTokens]'