Cloud Enumeration

Learning Objectives

By the end of this lesson, you will be able to:

Understand cloud enumeration.
Differentiate reconnaissance from enumeration.
Learn how cloud resources are enumerated.
Identify enterprise cloud assets.
Understand cloud identity enumeration.
Apply cloud enumeration during authorised penetration testing engagements.

Introduction

Reconnaissance tells us what exists.

Enumeration tells us how it is configured.

Once a Cloud Penetration Tester has identified cloud assets, the next step is to collect detailed information about those resources.

Enumeration provides the technical information required to:

Identify attack paths
Assess security posture
Validate configurations
Identify misconfigurations
Prioritise security testing

Without enumeration, cloud penetration testing is largely based on assumptions.

What is Cloud Enumeration?

Cloud Enumeration is the process of gathering detailed technical information from cloud environments using authorised access.

Unlike reconnaissance, enumeration interacts directly with cloud services and APIs.

Typical targets include:

IAM
Virtual Machines
Storage
Kubernetes
Containers
Networks
APIs
Serverless Functions
Databases

Reconnaissance vs Enumeration

Reconnaissance	Enumeration
Finds assets	Collects detailed information
Broad overview	Deep technical inspection
Mostly passive	Usually active
Identifies targets	Identifies configurations
Maps attack surface	Maps attack paths

Both stages are essential during enterprise penetration testing.

Cloud Enumeration Workflow

Reconnaissance

↓

Identity Enumeration

↓

Cloud Resource Enumeration

↓

Network Enumeration

↓

Storage Enumeration

↓

Compute Enumeration

↓

Container Enumeration

↓

Kubernetes Enumeration

↓

Application Enumeration

↓

Attack Path Analysis

Why Enumeration Matters

Enumeration allows penetration testers to answer questions such as:

Which identities exist?
What permissions do they have?
Which storage is public?
Which workloads are internet facing?
Which Kubernetes clusters exist?
Which APIs are exposed?
Which services communicate with each other?

The answers help identify realistic attack paths.

Identity Enumeration

Identity is one of the most valuable attack surfaces.

Review:

Users
Groups
Roles
Policies
Service Accounts
Federation
Multi-Factor Authentication (MFA)
Temporary Credentials

Questions to ask:

Who has administrative privileges?
Are unused accounts still active?
Are permissions excessive?
Is MFA enforced?

AWS IAM Enumeration

Examples:

aws sts get-caller-identity

aws iam list-users

aws iam list-roles

aws iam list-groups

aws iam list-policies

aws iam list-attached-user-policies

Review:

Administrator accounts
Inline policies
Managed policies
Access keys
Role trust relationships

Azure Identity Enumeration

Examples:

az account show

az ad user list

az ad group list

az role assignment list

Review:

Users
Groups
Role assignments
Service principals
Managed identities

Google Cloud Identity Enumeration

Examples:

gcloud auth list

gcloud projects get-iam-policy PROJECT_ID

Review:

IAM bindings
Service accounts
Roles
Permissions

Network Enumeration

Cloud networking defines how workloads communicate.

Review:

VPCs
VNets
Subnets
Route Tables
Internet Gateways
NAT Gateways
Firewalls
Security Groups
Network ACLs
VPNs

Questions:

Which workloads are internet facing?
Is segmentation implemented?
Are management ports exposed?

AWS Network Enumeration

Examples:

aws ec2 describe-vpcs

aws ec2 describe-subnets

aws ec2 describe-security-groups

aws ec2 describe-route-tables

Review:

Public subnets
Open inbound rules
Network segmentation
Internet gateways

Storage Enumeration

Review cloud storage for:

Public access
Encryption
Versioning
Logging
Lifecycle policies
Sensitive files

Common storage services:

Amazon S3
Azure Blob Storage
Google Cloud Storage

AWS Storage Enumeration

Examples:

aws s3 ls

aws s3api list-buckets

Review:

Bucket policies
Public access configuration
Server-side encryption
Access logging

Compute Enumeration

Review:

EC2 Instances
Azure Virtual Machines
Google Compute Engine

Check:

Operating systems
Instance roles
Public IP addresses
Running services
Security patches
Attached IAM roles

Container Enumeration

Review:

Images
Running containers
Registries
Dockerfiles
Runtime configuration
Security context

Questions:

Are containers running as root?
Are images trusted?
Are secrets exposed?

Kubernetes Enumeration

Kubernetes is one of the most important enumeration phases.

Review:

Nodes
Namespaces
Pods
Deployments
ReplicaSets
Services
ConfigMaps
Secrets
Network Policies
RBAC
Service Accounts
Ingress Resources

Kubernetes Commands

Examples:

kubectl get nodes

kubectl get namespaces

kubectl get pods --all-namespaces

kubectl get services --all-namespaces

kubectl get deployments --all-namespaces

kubectl get ingress --all-namespaces

Document all discovered resources.

RBAC Enumeration

Review:

ClusterRoles
Roles
ClusterRoleBindings
RoleBindings
Service Accounts

Examples:

kubectl get clusterroles

kubectl get clusterrolebindings

kubectl get roles --all-namespaces

Questions:

Who has cluster-admin?
Are service accounts over-privileged?
Can workloads escalate privileges?

Secret Enumeration

Review:

Kubernetes Secrets
AWS Secrets Manager
Azure Key Vault
Google Secret Manager

Never expose or misuse secrets during an authorised assessment.

Instead, verify:

Storage location
Access controls
Encryption
Rotation policy

API Enumeration

Cloud applications expose APIs that should be assessed.

Review:

API Gateways
REST APIs
GraphQL APIs
Authentication
Authorization
Rate limiting
Versioning

Questions:

Are APIs publicly accessible?
Is authentication enforced?
Are sensitive endpoints protected?

Serverless Enumeration

Review:

AWS Lambda
Azure Functions
Google Cloud Functions

Check:

IAM roles
Triggers
Environment variables
Logging
Secrets
Network connectivity

Logging Enumeration

Verify:

CloudTrail
CloudWatch
Azure Monitor
Google Cloud Logging
Kubernetes Audit Logs

Questions:

Is logging enabled?
Are logs protected?
Are logs centrally collected?
Are audit events retained?

Enumeration Deliverables

Professional assessments typically produce:

Asset Inventory
Identity Inventory
Network Diagram
Kubernetes Resource Inventory
IAM Review
Cloud Service Inventory
Storage Inventory
API Inventory
Initial Findings Register

These deliverables support later assessment and reporting phases.

Enterprise Scenario

CloudNova Technologies provides access to an AWS account for an authorised assessment.

Enumeration identifies:

214 IAM users
52 IAM roles
186 EC2 instances
47 S3 buckets
6 VPCs
3 Amazon EKS clusters
487 Kubernetes Pods
16 Load Balancers
11 Lambda functions
29 Security Groups

Further analysis reveals:

4 S3 buckets allow public read access.
3 IAM roles have administrator permissions.
18 Security Groups expose SSH to the internet.
2 Kubernetes service accounts are bound to cluster-admin.

These findings become priorities for deeper security testing.

Best Practices

Enumerate before attempting exploitation.
Verify findings through multiple sources.
Document every discovered resource.
Respect the approved scope.
Protect sensitive information.
Avoid making unnecessary changes.
Focus on understanding relationships between cloud resources.

Common Mistakes

Avoid:

Skipping identity enumeration.
Ignoring Kubernetes resources.
Failing to review IAM permissions.
Assuming default configurations are secure.
Forgetting to document findings.
Performing unauthorised modifications.
Treating enumeration as vulnerability exploitation.

Knowledge Check

1. What is the primary purpose of cloud enumeration?

Answer: Cloud enumeration collects detailed technical information about cloud resources, identities and configurations to identify attack paths and support security assessments.

2. How does enumeration differ from reconnaissance?

Answer: Reconnaissance identifies assets and provides a broad overview, while enumeration actively gathers detailed configuration and permission information about those assets.

3. Why is IAM enumeration important?

Answer: IAM enumeration identifies users, roles, permissions and trust relationships, helping penetration testers detect excessive privileges, weak access controls and potential privilege escalation paths.

4. Why should Kubernetes resources be enumerated?

Answer: Enumerating Kubernetes resources helps identify workloads, RBAC permissions, service accounts, secrets and network configurations that may introduce security risks.

5. Why is documentation important during enumeration?

Answer: Documentation creates an accurate inventory of cloud resources, supports vulnerability analysis and provides evidence for technical reports and remediation planning.

Key Takeaways

Enumeration transforms discovered assets into actionable security information.
Identity, networking, storage and Kubernetes are critical enumeration targets.
Cloud APIs and CLI tools enable authorised enumeration of cloud resources.
Accurate documentation improves the quality of penetration testing and reporting.
Enumeration is a foundational phase that prepares security testers for vulnerability assessment and attack path analysis.

What’s Next?

In the next lesson, we will explore Cloud Identity Attacks, learning how attackers target IAM, service accounts, federation, cloud credentials and privilege escalation paths across AWS, Azure and Google Cloud.

➡️ Next Lesson: Lesson 07 — Cloud Identity Attacks