Lab 01 — Build Your Cloud Pentesting Lab

Lab Information

Item	Details
Lab ID	CPS-LAB-001
Difficulty	Beginner
Duration	2–3 Hours
Cloud Provider	AWS Free Tier
Tools Required	AWS CLI, Kali Linux, Docker, Terraform, VS Code
Estimated Cost	Free Tier Eligible (≤ $5 if resources are not cleaned up)

Lab Overview

Welcome to your first Cloud Offensive Security lab.

Unlike traditional penetration testing, cloud pentesting requires an environment where you can safely deploy cloud infrastructure, practice reconnaissance, enumerate resources and assess cloud security controls.

By the end of this lab, you will have your own Cloud Pentesting Lab that will be used throughout the remainder of this learning path.

This environment mirrors what professional cloud penetration testers use during internal assessments and client engagements.

Learning Objectives

After completing this lab, you will be able to:

Build a cloud pentesting workstation.
Configure AWS CLI securely.
Deploy a dedicated AWS penetration testing account.
Install essential cloud security tools.
Verify access to AWS APIs.
Create a repeatable cloud testing environment.
Understand the lab architecture used throughout this course.

Enterprise Scenario

You have joined CloudNova Technologies as a Junior Cloud Penetration Tester.

Your team performs cloud security assessments against development and staging environments.

Before participating in customer engagements, every consultant must build a standardised cloud penetration testing workstation.

Your task is to prepare your environment.

Lab Architecture

                 Internet
                     │
                     │
        ┌────────────────────────┐
        │   Kali Linux Machine   │
        │------------------------│
        │ AWS CLI               │
        │ Azure CLI             │
        │ Google Cloud CLI      │
        │ Docker                │
        │ Terraform             │
        │ kubectl               │
        │ Git                   │
        │ VS Code               │
        │ Trivy                 │
        │ ScoutSuite            │
        └──────────┬────────────┘
                   │
         Secure AWS Authentication
                   │
          AWS Free Tier Account
                   │
         AWS Services Used Later
        ┌────────────────────────┐
        │ IAM                    │
        │ EC2                    │
        │ S3                     │
        │ VPC                    │
        │ Lambda                 │
        │ EKS                    │
        └────────────────────────┘

Lab Prerequisites

You should have:

AWS Free Tier Account
MFA enabled
Kali Linux (VM or physical machine)
Internet connection
VS Code installed
Git installed

Mission 1 — Create a Working Folder

Create a dedicated workspace.

mkdir ~/cloud-pentesting-lab

cd ~/cloud-pentesting-lab

Expected Output

cloud-pentesting-lab/

Mission 2 — Install AWS CLI

Verify installation.

aws --version

Expected Output

aws-cli/2.x.x

If AWS CLI is missing, install it.

Ubuntu/Kali

sudo apt update

sudo apt install awscli -y

Mission 3 — Configure AWS CLI

Run:

aws configure

Enter:

AWS Access Key

AWS Secret Key

Region

Output Format

Example

Region

ap-south-1

Mission 4 — Verify AWS Authentication

Run

aws sts get-caller-identity

Expected Output

{
 "Account":"123456789012",
 "Arn":"arn:aws:iam::123456789012:user/student"
}

Mission 5 — Install Docker

Verify Docker.

docker --version

If missing:

sudo apt install docker.io -y

Enable Docker.

sudo systemctl enable docker

sudo systemctl start docker

Mission 6 — Install kubectl

Verify installation.

kubectl version --client

Expected Output

Client Version

Mission 7 — Install Terraform

Verify installation.

terraform version

Expected Output

Terraform v1.x

Terraform will be used throughout upcoming labs.

Mission 8 — Install Git

Verify Git.

git --version

Expected Output

git version 2.x

Mission 9 — Install Visual Studio Code

Verify VS Code launches successfully.

Useful extensions:

Terraform
Docker
Kubernetes
YAML
GitHub Copilot
Markdown All in One

Mission 10 — Install Trivy

Install Trivy.

sudo apt install wget -y

wget https://github.com/aquasecurity/trivy/releases/latest/download/trivy_0.64.1_Linux-64bit.deb

sudo dpkg -i trivy_*.deb

Verify.

trivy version

Mission 11 — Install ScoutSuite

Install ScoutSuite.

pip install scoutsuite

Verify.

scout --help

ScoutSuite will later assess AWS security posture.

Mission 12 — Verify AWS Permissions

Run:

aws iam list-users

If successful, AWS connectivity is working.

If Access Denied appears, review IAM permissions before proceeding.

Mission 13 — Create Lab Folder Structure

Create folders.

mkdir tools

mkdir reports

mkdir screenshots

mkdir terraform

mkdir scripts

mkdir notes

Verify.

tree

Expected Output

cloud-pentesting-lab/

├── notes
├── reports
├── screenshots
├── scripts
├── terraform
└── tools

Mission 14 — Verify Installed Tools

Run.

aws --version

docker --version

kubectl version --client

terraform version

git --version

trivy version

Everything should execute successfully.

Mission 15 — Test Internet Connectivity

Run.

curl https://aws.amazon.com

Expected Output

<HTML...

Validation Checklist

Verify:

Troubleshooting

AWS CLI Authentication Failure

Check credentials.

aws configure

Verify:

aws sts get-caller-identity

Docker Permission Error

Run.

sudo usermod -aG docker $USER

Log out and log back in.

Terraform Missing

Verify PATH.

terraform version

kubectl Missing

Reinstall kubectl and verify.

kubectl version --client

Lab Challenge

Without referring to the instructions:

Configure AWS CLI from scratch.
Verify authentication.
Create the lab directory structure.
Install Terraform.
Install Trivy.
Install Docker.
Verify every tool.

Document your results.

Knowledge Check

1. Why should cloud penetration testers use a dedicated AWS account?

Answer: To safely perform authorised testing without affecting production resources or personal cloud environments.

2. Why is AWS CLI required?

Answer: It enables interaction with AWS services through authenticated API calls, allowing testers to enumerate resources, validate permissions and automate assessments.

3. Why is Terraform included in the lab?

Answer: Terraform allows infrastructure to be deployed, modified and removed consistently using Infrastructure as Code (IaC), making labs repeatable and easier to manage.

4. What is the purpose of Trivy?

Answer: Trivy scans container images, file systems and Infrastructure as Code for known vulnerabilities and misconfigurations.

5. Why is ScoutSuite useful?

Answer: ScoutSuite performs automated cloud security posture assessments, identifying insecure configurations and providing recommendations for improvement.

Key Takeaways

A professional cloud pentesting workstation includes cloud CLIs, container tooling, Infrastructure as Code tools and security assessment utilities.
AWS CLI authentication is the foundation for interacting with AWS services during assessments.
Using a structured lab environment improves consistency and repeatability across penetration testing engagements.
Tools such as Terraform, Docker, Trivy and ScoutSuite are commonly used in enterprise cloud security assessments.
This lab environment will be reused throughout the AWS, Azure and Google Cloud penetration testing modules.

What’s Next?

In the next lab, you will begin Lab 02 — Cloud Reconnaissance, where you will perform passive and active reconnaissance against a controlled cloud environment, discover cloud assets and map the attack surface just as a professional Cloud Penetration Tester would.

➡️ Next Lab: Lab 02 — Cloud Reconnaissance