Lab 03 — Cloud Enumeration

Lab Information

Item	Details
Lab ID	CPS-LAB-003
Difficulty	Beginner → Intermediate
Duration	2–3 Hours
Cloud Provider	AWS
Tools Required	AWS CLI, jq, kubectl, ScoutSuite, PMapper (Optional)
Estimated Cost	Free Tier Eligible

Lab Overview

Reconnaissance tells us what exists publicly.

Enumeration tells us what exists inside the cloud environment after authenticated access.

Professional Cloud Penetration Testers spend a significant amount of time enumerating cloud resources before attempting any validation or exploitation.

Poor enumeration leads to missed attack paths.

Good enumeration leads to complete security assessments.

In this lab, you will enumerate an AWS environment exactly as a Cloud Security Consultant would during an enterprise penetration test.

Learning Objectives

After completing this lab, you will be able to:

Enumerate AWS identities.
Identify IAM permissions.
Discover EC2 instances.
Enumerate S3 buckets.
Review VPC networking.
Identify Lambda functions.
Discover EKS clusters.
Document attack surfaces.
Produce an enterprise asset inventory.

Enterprise Scenario

CloudNova Technologies has received temporary read-only access to FinSecure Bank’s AWS Development Account.

Your objective is to discover:

Cloud resources
Cloud identities
Network architecture
Kubernetes clusters
Storage
Compute resources

No exploitation is permitted.

Only enumeration.

Lab Architecture

                AWS Account

                     │

     ┌───────────────┼───────────────┐
     │               │               │

    IAM             VPC            S3

     │               │               │

    EC2          Lambda         CloudTrail

     │

    Amazon EKS

     │

 Kubernetes Cluster

Lab Prerequisites

Complete:

Lab 01 — Build Your Cloud Pentesting Lab
Lab 02 — Cloud Reconnaissance

Verify:

aws sts get-caller-identity

Mission 1 — Verify Authentication

Run:

aws sts get-caller-identity

Expected Output

{
 "Account":"123456789012",
 "Arn":"arn:aws:iam::123456789012:user/student"
}

Mission 2 — Enumerate IAM Users

List users.

aws iam list-users

Document:

User Names
Creation Date
Path

Questions:

Which users appear inactive?
Which users may be administrative?

Mission 3 — Enumerate IAM Roles

Run:

aws iam list-roles

Document:

Role Name
Trusted Entity
Description

Review:

Administrator roles
EC2 roles
Lambda roles
EKS roles

Mission 4 — Review IAM Policies

List policies.

aws iam list-policies --scope Local

Review:

AdministratorAccess
PowerUserAccess
Custom Policies

Identify overly permissive policies.

Mission 5 — Enumerate IAM Groups

Run:

aws iam list-groups

Identify:

Administrators
Developers
DevOps
ReadOnly

Mission 6 — Enumerate Access Keys

Run:

aws iam list-access-keys --user-name USERNAME

Review:

Active Keys
Key Age
Rotation Status

Mission 7 — Enumerate EC2 Instances

Run:

aws ec2 describe-instances

Document:

Instance ID
Public IP
Private IP
IAM Role
Operating System
Security Group

Mission 8 — Enumerate Security Groups

Run:

aws ec2 describe-security-groups

Review:

Open Ports
Source CIDRs
Internet Access

Questions:

Is SSH exposed?
Is RDP public?
Are database ports exposed?

Mission 9 — Enumerate Amazon S3

List buckets.

aws s3 ls

Review bucket settings.

aws s3api get-bucket-policy \
--bucket BUCKET_NAME

Check:

Public Access
Encryption
Versioning

Mission 10 — Enumerate VPC

Run:

aws ec2 describe-vpcs

Review:

CIDR
Internet Gateway
Route Tables

Mission 11 — Enumerate Subnets

Run:

aws ec2 describe-subnets

Document:

Public Subnets
Private Subnets
Availability Zones

Mission 12 — Enumerate Lambda Functions

Run:

aws lambda list-functions

Review:

Runtime
IAM Role
Environment Variables

Mission 13 — Enumerate Amazon EKS

List clusters.

aws eks list-clusters

Describe cluster.

aws eks describe-cluster \
--name CLUSTER_NAME

Review:

Endpoint
Logging
Version
IAM Authentication

Mission 14 — Enumerate Kubernetes

Update kubeconfig.

aws eks update-kubeconfig \
--name CLUSTER_NAME

Verify access.

kubectl get nodes

Continue with:

kubectl get namespaces

kubectl get pods -A

kubectl get services -A

kubectl get secrets -A

kubectl get clusterroles

Document findings.

Mission 15 — Enumerate CloudTrail

Run:

aws cloudtrail describe-trails

Review:

Enabled Trails
Multi-Region Logging
Encryption
Log Validation

Mission 16 — Enumerate AWS Config

Run:

aws configservice describe-configuration-recorders

Verify:

Recorder Enabled
Recording Scope

Mission 17 — Generate Asset Inventory

Create a spreadsheet containing:

Asset	Quantity	Risk
IAM Users
IAM Roles
EC2
Security Groups
S3 Buckets
Lambda
EKS Clusters
VPCs

Mission 18 — Identify Potential Attack Paths

Example:

Developer IAM User

↓

Administrator Role

↓

EC2 Instance

↓

S3 Bucket

↓

Sensitive Data

Identify at least three possible attack paths.

Deliverables

Produce:

Cloud Asset Inventory
IAM Inventory
EC2 Inventory
Storage Inventory
Kubernetes Inventory
Network Inventory
Attack Path Diagram
Enumeration Report

Validation Checklist

Verify:

Troubleshooting

Access Denied

Check:

aws sts get-caller-identity

Confirm the IAM role has read permissions.

No EKS Clusters Found

Run:

aws configure get region

Ensure you are using the correct AWS Region.

kubectl Cannot Connect

Update kubeconfig again.

aws eks update-kubeconfig \
--name CLUSTER_NAME

Empty Results

Verify that resources exist within the selected AWS account and region.

Lab Challenge

Without following the guided steps:

Discover every IAM identity.
Build a complete network inventory.
Identify all storage resources.
Enumerate every Kubernetes object.
Produce an enterprise asset inventory.
Create three realistic cloud attack paths.
Write an executive summary of your findings.

Knowledge Check

1. Why is enumeration important after reconnaissance?

Answer: Reconnaissance identifies publicly visible assets, while enumeration provides authenticated insight into cloud identities, services, permissions and configurations required for a complete security assessment.

2. Which AWS service provides identity and access management?

Answer: AWS Identity and Access Management (IAM).

3. Why should Security Groups be reviewed during enumeration?

Answer: Security Groups define network access to cloud resources. Misconfigured rules may expose management ports, applications or databases to unauthorized users.

4. Why should CloudTrail be included in an enumeration exercise?

Answer: CloudTrail provides audit logs of AWS API activity, helping assess monitoring capabilities and supporting incident investigations.

5. What is the primary outcome of a cloud enumeration phase?

Answer: A comprehensive inventory of cloud assets, identities, configurations and potential attack paths that guides the remainder of the penetration test.

Key Takeaways

Enumeration is the foundation of every professional cloud penetration test.
IAM, compute, storage, networking and Kubernetes should all be systematically reviewed.
A complete asset inventory enables accurate attack-path analysis and risk prioritization.
Cloud enumeration focuses on visibility and documentation rather than exploitation.
High-quality enumeration significantly improves the effectiveness of later penetration testing phases.

What’s Next?

In the next lab, you will perform Lab 04 — Cloud Identity Assessment, where you will analyse IAM users, roles, policies, trust relationships and privilege escalation opportunities using enterprise cloud security assessment methodologies.

➡️ Next Lab: Lab 04 — Cloud Identity Assessment