Lesson 05 — Amazon EC2 Exploitation

Learning Objectives

By the end of this lesson, you will be able to:

Understand the EC2 attack surface.
Identify common EC2 security weaknesses.
Understand Instance Metadata Service (IMDS) attacks.
Review EC2 IAM Roles and Instance Profiles.
Understand privilege escalation from EC2.
Assess EC2 configurations using enterprise methodologies.
Identify attack paths involving Amazon EC2.

Introduction

Amazon EC2 is one of the most heavily used AWS services.

Organizations host:

Web Applications
APIs
Databases
CI/CD Runners
Bastion Hosts
Kubernetes Worker Nodes
Internal Applications

Because EC2 instances frequently process sensitive workloads and possess IAM permissions, they are one of the primary targets during AWS penetration testing.

Unlike traditional virtual machines, EC2 instances interact directly with AWS APIs through IAM Roles, making identity security just as important as operating system security.

Enterprise Scenario

CloudNova Technologies has been hired to assess the AWS infrastructure of FinSecure Bank Ltd.

The customer operates:

650 Amazon EC2 Instances
4 Production VPCs
Auto Scaling Groups
Amazon EKS Worker Nodes
Internal Banking Applications
Internet-facing APIs

Your task is to determine whether attackers could compromise EC2 instances and pivot into the wider AWS environment.

Amazon EC2 Architecture

Internet

↓

Application Load Balancer

↓

Amazon EC2

↓

IAM Role

↓

AWS APIs

↓

Amazon S3

↓

Secrets Manager

↓

Amazon RDS

A compromised EC2 instance may become the starting point for an enterprise cloud attack.

EC2 Attack Surface

Cloud Penetration Testers typically assess:

Public EC2 Instances
Security Groups
SSH Exposure
RDP Exposure
IAM Instance Profiles
Instance Metadata Service
User Data Scripts
EBS Volumes
AMIs
Patch Levels
Endpoint Protection

Common EC2 Misconfigurations

Frequently observed issues include:

Public IP addresses assigned unnecessarily.
SSH open to the internet (0.0.0.0/0).
RDP exposed publicly.
IMDSv1 enabled.
Administrator IAM Roles attached.
Unpatched operating systems.
Weak SSH keys.
Hardcoded AWS credentials.
No disk encryption.
Disabled logging.

Instance Metadata Service (IMDS)

Every EC2 instance can access the Instance Metadata Service.

The metadata service provides:

Instance Information
Network Configuration
IAM Role Credentials
Region Information
Instance Identity

Accessed locally using:

http://169.254.169.254

IMDSv1 vs IMDSv2

IMDSv1

No session authentication
Vulnerable to SSRF attacks
Legacy implementation

IMDSv2

Session-oriented
Token-based authentication
Protection against several metadata abuse techniques

Enterprise environments should enforce IMDSv2.

Metadata Credential Theft

If an attacker compromises an EC2 instance, they may attempt to retrieve temporary credentials.

Example:

curl http://169.254.169.254/latest/meta-data/

If IAM Roles are attached, temporary credentials may be exposed.

These credentials can then be used to interact with AWS APIs within the permissions granted to the role.

IAM Instance Profiles

An Instance Profile attaches an IAM Role to an EC2 instance.

Example:

Amazon EC2

↓

Instance Profile

↓

IAM Role

↓

Amazon S3

↓

Secrets Manager

↓

CloudWatch

Assess:

Attached permissions
Trust policy
Least privilege
Resource access

User Data Scripts

User Data executes automatically during instance launch.

Review for:

Hardcoded credentials
API Keys
Tokens
Passwords
Installation scripts

Example:

#!/bin/bash

yum update -y

aws s3 cp s3://company-config/app.conf .

Sensitive information should never be embedded in User Data.

Security Groups

Review inbound rules.

Example:

Port	Source	Risk
22	0.0.0.0/0	High
3389	0.0.0.0/0	High
443	Internet	Expected
80	Internet	Expected

Management ports should only be accessible from trusted administrative networks.

EBS Volume Security

Review:

Encryption
Snapshots
Attached Volumes
Unused Volumes
Snapshot Sharing

Risks include:

Unencrypted disks
Public snapshots
Sensitive backups

AMI Assessment

Amazon Machine Images should be reviewed for:

Patch level
Operating System version
Installed software
Security agents
Unnecessary services

Outdated AMIs introduce unnecessary risk into new deployments.

Enterprise Attack Path

Internet

↓

Public EC2

↓

SSRF

↓

IMDSv1

↓

IAM Role

↓

Amazon S3

↓

Customer Database Backup

↓

Data Exfiltration

This is one of the most common AWS attack chains observed in cloud security assessments.

EC2 Enumeration Commands

List instances

aws ec2 describe-instances

Describe Security Groups

aws ec2 describe-security-groups

Describe Instance Profiles

aws iam list-instance-profiles

Describe EBS Volumes

aws ec2 describe-volumes

Describe Snapshots

aws ec2 describe-snapshots --owner-ids self

Describe AMIs

aws ec2 describe-images --owners self

Enterprise Assessment Workflow

Professional consultants generally follow this methodology.

Enumerate EC2

↓

Review Public Exposure

↓

Review Security Groups

↓

Assess IAM Roles

↓

Review IMDS Configuration

↓

Review Storage

↓

Review User Data

↓

Identify Attack Paths

↓

Document Findings

Common Enterprise Findings

Examples include:

Public SSH access
Public RDP access
IMDSv1 enabled
Administrator IAM Roles
Hardcoded AWS credentials
Missing EBS encryption
Public snapshots
Outdated AMIs
Weak Security Groups
Missing endpoint protection

Security Best Practices

Require IMDSv2 on all instances.
Remove unnecessary public IP addresses.
Restrict SSH and RDP access.
Use least-privilege IAM Roles.
Encrypt all EBS volumes.
Regularly patch operating systems.
Store secrets in AWS Secrets Manager instead of User Data.
Enable CloudTrail and VPC Flow Logs.
Use Systems Manager Session Manager instead of internet-facing SSH where possible.

Common Mistakes

Avoid:

Attaching AdministratorAccess to EC2 roles.
Leaving IMDSv1 enabled.
Allowing unrestricted SSH access.
Storing credentials in User Data.
Using outdated AMIs.
Creating public EBS snapshots.
Ignoring Security Group reviews.

Knowledge Check

1. Why are EC2 instances attractive targets for attackers?

Answer: EC2 instances often host critical workloads, possess IAM permissions and can provide access to additional AWS services if compromised.

2. Why is IMDSv2 recommended over IMDSv1?

Answer: IMDSv2 uses session-oriented, token-based authentication that helps protect against metadata abuse techniques such as Server-Side Request Forgery (SSRF).

3. What is an IAM Instance Profile?

Answer: An Instance Profile associates an IAM Role with an EC2 instance, allowing applications to obtain temporary AWS credentials without storing long-lived access keys.

4. Why should Security Groups be reviewed during EC2 assessments?

Answer: Security Groups define network access to EC2 instances. Overly permissive rules may expose management interfaces or applications to unauthorized users.

5. Why should penetration testers review User Data scripts?

Answer: User Data scripts may contain sensitive information such as credentials, API keys or configuration details that could increase the impact of a compromised EC2 instance.

Key Takeaways

Amazon EC2 remains one of the most important services assessed during AWS penetration testing.
IAM Roles attached to EC2 instances significantly influence the potential impact of compromise.
IMDSv2, least-privilege IAM Roles and restricted Security Groups are key defensive controls.
Reviewing storage, networking and metadata configurations provides a more complete assessment than operating system checks alone.
Enterprise EC2 assessments should focus on realistic attack paths that combine network exposure, identity permissions and cloud resources.

What’s Next?

In the next lesson, you will explore Amazon S3 Security Testing, learning how attackers identify insecure S3 buckets, assess bucket policies, review encryption and versioning, discover public exposure and understand common cloud storage attack techniques.

➡️ Next Lesson: Lesson 06 — Amazon S3 Security Testing