Lab 05 — Mini Cloud Penetration Test

Lab Information

Item	Details
Lab ID	CPS-LAB-005
Difficulty	Intermediate
Duration	3–4 Hours
Cloud Provider	AWS
Environment	Simulated Enterprise AWS Account
Tools Required	AWS CLI, ScoutSuite, PMapper (Optional), Trivy, kubectl, jq, VS Code
Estimated Cost	Free Tier Eligible

Lab Overview

This lab combines everything you have learned throughout Module 01.

Instead of following isolated exercises, you will perform a complete cloud penetration testing engagement similar to what professional consultants perform for enterprise customers.

You will:

Review the engagement scope
Perform reconnaissance
Enumerate cloud resources
Assess IAM
Review storage and compute security
Assess Kubernetes (Amazon EKS)
Identify attack paths
Prioritize risks
Produce an executive report

No exploitation is performed in this lab.

The focus is on professional assessment methodology.

Learning Objectives

After completing this lab, you will be able to:

Conduct an end-to-end cloud security assessment.
Perform structured cloud reconnaissance.
Enumerate AWS resources.
Review IAM security.
Assess cloud storage.
Review EC2 security.
Assess Kubernetes security.
Build enterprise attack paths.
Produce a professional penetration testing report.

Enterprise Scenario

CloudNova Technologies has been contracted to perform an annual security assessment for FinSecure Bank Ltd.

The client wants assurance that their AWS environment is secure before a major production release.

You have been granted temporary read-only assessment access to the AWS development environment.

Your mission is to identify security weaknesses, explain business impact and provide remediation guidance.

Rules of Engagement

In Scope

IAM
EC2
Amazon S3
VPC
Amazon EKS
Lambda
CloudTrail
AWS Config

Out of Scope

Denial of Service (DoS)
Production customer data
Social engineering
Credential harvesting
Password attacks
Exploitation beyond approved validation

Lab Architecture

                    Internet
                        │
                Application Load Balancer
                        │
                Amazon EKS Cluster
                        │
        ┌───────────────┼────────────────┐
        │               │                │
      Pods         Microservices      APIs
        │
        │
     IAM Roles
        │
   Amazon S3
        │
 Amazon RDS Database
        │
   CloudTrail

Mission 1 — Review Assessment Scope

Before beginning:

Review Rules of Engagement.
Identify assessment objectives.
Confirm AWS account.
Verify authentication.

Run:

aws sts get-caller-identity

Mission 2 — Perform Reconnaissance

Document:

Public DNS
Public Applications
Cloud Provider
APIs
CDN
Public Assets

Create:

Asset Inventory
Attack Surface Diagram

Mission 3 — Enumerate IAM

Review:

aws iam list-users

aws iam list-roles

aws iam list-groups

Document:

Administrator accounts
Service Accounts
Roles
Policies
MFA status

Mission 4 — Review IAM Permissions

Review attached policies.

aws iam list-attached-user-policies

aws iam list-attached-role-policies

Identify:

Wildcards
AdministratorAccess
PowerUserAccess
iam:PassRole
sts:AssumeRole

Mission 5 — Assess EC2

Review:

aws ec2 describe-instances

aws ec2 describe-security-groups

Document:

Public IPs
Open ports
IAM Roles
Security Groups
Metadata configuration

Mission 6 — Assess Amazon S3

List buckets.

aws s3 ls

Review:

Bucket Policy
Public Access
Encryption
Versioning
Logging

Identify exposed storage.

Mission 7 — Assess Networking

Review:

aws ec2 describe-vpcs

aws ec2 describe-subnets

aws ec2 describe-route-tables

Document:

Public Subnets
Internet Gateways
NAT Gateways
Network Segmentation

Mission 8 — Assess Lambda

Review:

aws lambda list-functions

Document:

Runtime
IAM Role
Environment Variables

Mission 9 — Assess Amazon EKS

List clusters.

aws eks list-clusters

Connect.

aws eks update-kubeconfig \
--name CLUSTER_NAME

Review:

kubectl get nodes

kubectl get pods -A

kubectl get secrets -A

kubectl get clusterroles

kubectl get networkpolicies -A

Document:

Privileged Pods
Service Accounts
Secrets
RBAC
Network Policies

Mission 10 — Review Logging

Review:

aws cloudtrail describe-trails

aws configservice describe-configuration-recorders

Determine:

CloudTrail enabled
Multi-region logging
AWS Config enabled
Audit coverage

Mission 11 — Identify Findings

Record every finding.

Example:

Finding	Risk
Public S3 Bucket	Critical
Administrator without MFA	Critical
SSH Open to Internet	High
Privileged Pod	High
Missing Network Policies	Medium

Mission 12 — Build Attack Paths

Example 1

Developer IAM User

↓

Administrator Role

↓

Amazon EC2

↓

Amazon S3

↓

Customer Data

Example 2

Public Application

↓

Amazon EKS

↓

Service Account

↓

IAM Role

↓

Amazon S3

Example 3

Compromised Lambda

↓

IAM Role

↓

Secrets Manager

↓

Production Database

Mission 13 — Risk Prioritization

Classify findings.

Severity	Description
Critical	Immediate business impact
High	Major security weakness
Medium	Moderate risk
Low	Minor improvement
Informational	Best practice recommendation

Mission 14 — Executive Report

Produce the following sections:

Executive Summary

Describe:

Overall security posture
High-level risks
Business impact

Technical Findings

For each finding include:

Description
Evidence
Risk
Impact
Recommendation

Attack Path Analysis

Illustrate:

Entry Point
Identity
Privilege Escalation
Lateral Movement
Data Access

Risk Register

Include:

Risk
Severity
Owner
Target Date

Remediation Roadmap

Immediate (0–30 Days)

Enable MFA
Remove public storage
Remove wildcard permissions

Short-Term (30–90 Days)

Review IAM
Enable IMDSv2
Implement Network Policies
Harden Kubernetes

Long-Term

CSPM
Continuous Compliance
Runtime Detection
Quarterly Assessments

Mission 15 — Present Findings

Prepare a 10-minute executive presentation covering:

Assessment scope
Key findings
Business risks
Attack paths
Recommended remediation
Next steps

Expected Deliverables

Create:

Executive Summary
Technical Assessment Report
IAM Review
Storage Assessment
Compute Assessment
Kubernetes Assessment
Attack Surface Diagram
Attack Path Diagram
Risk Register
Remediation Roadmap
Executive Presentation

Validation Checklist

Verify:

Enterprise Challenge

Without using the step-by-step guide:

Complete a full AWS assessment.
Build a complete asset inventory.
Identify at least 10 security findings.
Prioritize findings using risk ratings.
Create three enterprise attack paths.
Write an executive summary.
Produce a technical penetration testing report.
Present findings to a simulated executive board.

Knowledge Check

1. What is the first activity in a professional cloud penetration test?

Answer: Confirm authorization, review the Rules of Engagement and verify the assessment scope before interacting with the environment.

2. Why should findings be prioritized instead of reported equally?

Answer: Risk-based prioritization helps organizations focus on remediating the issues that present the greatest business impact and likelihood of exploitation.

3. What is an attack path?

Answer: An attack path is a sequence of weaknesses that an attacker can chain together to move from an initial foothold to high-value resources or sensitive data.

4. Why is an executive summary included in penetration testing reports?

Answer: Executive summaries communicate the overall security posture, business risks and recommended actions in language that non-technical stakeholders can understand.

5. What is the primary goal of this lab?

Answer: To simulate a real-world cloud penetration testing engagement by applying reconnaissance, enumeration, assessment, attack-path analysis and professional reporting skills in a structured enterprise scenario.

Key Takeaways

A successful cloud penetration test follows a structured methodology rather than focusing solely on exploitation.
Identity, storage, compute, networking and Kubernetes must all be assessed to understand the overall cloud security posture.
Attack-path analysis provides greater value than isolated vulnerability identification.
Professional deliverables include executive reports, technical findings, risk registers and remediation roadmaps.
Completing this lab prepares you for hands-on offensive security assessments in Module 02 — AWS Cloud Penetration Testing, where you will begin evaluating individual AWS services in depth.

Congratulations!

🎉 You have successfully completed the practical labs for Module 01 — Cloud Offensive Security Foundations.

You are now ready to progress to Module 02 — AWS Cloud Penetration Testing, where you will perform hands-on security assessments of AWS IAM, EC2, S3, VPC, Lambda, EKS, CloudTrail and additional AWS services using enterprise penetration testing methodologies.