Lab 03 — Amazon EC2 Exploitation

Lab Information

Item	Value
Module	02 — AWS Cloud Penetration Testing
Lab	03 — Amazon EC2 Exploitation
Difficulty	Intermediate
Estimated Time	120 Minutes
Lab Type	AWS Offensive Security
Tools	AWS CLI, EC2, IAM, Systems Manager, Trivy (Optional), ScoutSuite (Optional)
Prerequisites	AWS Account, AWS CLI Configured, EC2 Read Access
Assessment Type	Enterprise EC2 Security Assessment

Mission Brief

You are a Cloud Penetration Tester working for CloudNova Technologies.

Your client, FinSecure Bank Ltd, has requested an enterprise security assessment of their Amazon EC2 infrastructure after concerns regarding exposed servers and excessive IAM permissions.

Your objective is to identify EC2 security weaknesses, validate attack paths and recommend remediation before the environment moves into production.

Learning Objectives

After completing this lab, you will be able to:

Enumerate Amazon EC2 instances.
Identify public exposure.
Review Security Groups.
Assess IAM Instance Profiles.
Evaluate IMDS configuration.
Review EBS encryption.
Assess User Data scripts.
Build enterprise EC2 attack paths.
Produce an executive security assessment.

Enterprise Environment

The AWS environment contains:

Public Web Servers
Internal Application Servers
Bastion Hosts
Auto Scaling Groups
Amazon EKS Worker Nodes
Production Databases
Shared IAM Roles
CloudWatch Monitoring

Your goal is to determine whether an attacker could compromise EC2 instances and pivot deeper into the AWS environment.

Lab Architecture

Internet

↓

Application Load Balancer

↓

Amazon EC2

↓

IAM Role

↓

AWS APIs

↓

Amazon S3

↓

Secrets Manager

↓

Amazon RDS

Success Criteria

You successfully complete this lab when you can:

Enumerate all EC2 instances.
Identify internet-facing systems.
Review Security Groups.
Assess IAM Roles.
Validate IMDS configuration.
Review EBS encryption.
Build an EC2 attack path.
Produce a professional assessment report.

Task 1 — Verify AWS Access

Confirm your AWS identity.

aws sts get-caller-identity

Document:

AWS Account ID
IAM Identity
Region

Task 2 — Enumerate EC2 Instances

List all EC2 instances.

aws ec2 describe-instances

Document:

Instance ID
Name
State
VPC
Subnet
Public IP
Private IP
Platform
IAM Role

Questions:

Which instances are internet-facing?
Which belong to production?
Which appear unused?

Task 3 — Identify Public Exposure

Filter public instances.

aws ec2 describe-instances \
--query "Reservations[*].Instances[*].[InstanceId,PublicIpAddress]"

Review:

Public IP addresses
Elastic IPs
Internet-facing workloads

Questions:

Which systems are accessible from the internet?
Is public access justified?

Task 4 — Review Security Groups

List Security Groups.

aws ec2 describe-security-groups

Review:

SSH (22)
RDP (3389)
HTTP (80)
HTTPS (443)
Custom Ports

Questions:

Are any ports open to 0.0.0.0/0?
Which Security Groups require remediation?

Task 5 — Review IAM Instance Profiles

Retrieve Instance Profiles.

aws iam list-instance-profiles

Review:

Attached IAM Roles
AdministratorAccess
Wildcard permissions
Trust relationships

Questions:

Which EC2 instances have excessive permissions?
Could an attacker abuse these roles?

Task 6 — Assess Instance Metadata Service (IMDS)

Review IMDS configuration.

aws ec2 describe-instances \
--query "Reservations[*].Instances[*].MetadataOptions"

Verify:

IMDS Version
HttpTokens
HttpEndpoint

Questions:

Which instances still use IMDSv1?
Which should be migrated to IMDSv2?

Task 7 — Review User Data

Retrieve User Data.

aws ec2 describe-instance-attribute \
--instance-id INSTANCE_ID \
--attribute userData

Review:

Hardcoded credentials
API Keys
Passwords
Installation scripts

Questions:

Are secrets stored in User Data?
Should sensitive values be moved to Secrets Manager?

Task 8 — Review EBS Volumes

List EBS volumes.

aws ec2 describe-volumes

Review:

Encryption
Volume Type
Size
Attachment
Snapshot Source

Questions:

Which volumes are unencrypted?
Are snapshots protected?

Task 9 — Review Amazon Machine Images (AMIs)

List AMIs.

aws ec2 describe-images --owners self

Review:

Operating System
Patch Level
Image Age
Installed Security Agents

Questions:

Are outdated AMIs still in use?
Are hardened golden images available?

Task 10 — Review Systems Manager

List managed instances.

aws ssm describe-instance-information

Review:

Managed Status
Ping Status
Platform
Agent Version

Questions:

Are all production instances managed?
Can SSH exposure be reduced using Session Manager?

Task 11 — Review CloudWatch Monitoring

Review monitoring configuration.

aws cloudwatch list-metrics

Verify:

CPU Monitoring
Disk Monitoring
Network Monitoring
Custom Metrics

Questions:

Which critical servers lack monitoring?
Are alarms configured?

Task 12 — Identify EC2 Attack Path

Create an attack path similar to:

Internet

↓

Public EC2

↓

IMDSv1

↓

IAM Role

↓

Amazon S3

↓

Sensitive Customer Data

Document:

Initial Access
Privilege Escalation
Lateral Movement
Business Impact

Task 13 — Risk Assessment

Classify findings.

Finding	Severity
Public SSH Access	Critical
IMDSv1 Enabled	High
Administrator IAM Role	Critical
Unencrypted EBS Volume	High
Hardcoded Credentials	Critical
Weak Security Group	High
Missing Monitoring	Medium

Task 14 — Executive Recommendations

Recommend improvements such as:

Enforce IMDSv2.
Remove public SSH access.
Replace AdministratorAccess with least privilege.
Encrypt all EBS volumes.
Remove secrets from User Data.
Use AWS Systems Manager Session Manager.
Enable CloudWatch alarms.
Regularly patch AMIs.

Bonus Challenge

Perform an EC2 security review using:

ScoutSuite
Trivy
Prowler

Compare automated findings with your manual assessment and identify any additional risks.

Deliverables

Prepare an assessment containing:

EC2 Asset Inventory
Public Exposure Review
Security Group Assessment
IAM Role Review
IMDS Assessment
EBS Encryption Review
User Data Review
Attack Path Diagram
Executive Summary
Remediation Plan

Expected Outcome

After completing this lab, you will have:

Enumerated enterprise EC2 infrastructure.
Identified exposed compute resources.
Assessed IAM roles and metadata security.
Reviewed storage encryption and monitoring.
Built a realistic EC2 attack path.
Produced a professional enterprise EC2 penetration testing report.

Key Takeaways

Amazon EC2 remains one of the most frequently targeted AWS services due to its exposure and integration with IAM.
IMDSv2, least-privilege IAM roles and secure Security Groups significantly reduce attack opportunities.
Reviewing compute, identity, networking and storage together provides a complete picture of EC2 security.
Enterprise penetration testing should focus on realistic attack paths rather than isolated vulnerabilities.
Strong monitoring, patching and configuration management improve the resilience of EC2 environments.

Next Lab

➡️ Lab 04 — AWS Privilege Escalation