---
title: Advanced AWS Penetration Testing Reference
source: skills/aws-penetration-testing/references/advanced-aws-pentesting.md
---

# Advanced AWS Penetration Testing Guide

This guide provides an overview of various techniques and tools used for advanced penetration testing on Amazon Web Services (AWS). The following sections cover topics such as container security, database exploitation, VPC enumeration, lateral movement, and a security checklist.

## Table of Contents
1. [Container Security](#container-security)
2. [Database Exploitation](#database-exploitation)
3. [VPC Enumeration & Lateral Movement](#vpc-enumeration--lateral-movement)
4. [Security Checklist](#security-checklist)

## Container Security

This section outlines the enumeration, backdooring, and secrets extraction techniques for Amazon Elastic Container Service (ECS), Amazon Elastic Kubernetes Service (EKS), and Amazon Elastic Container Registry (ECR).

### ECR Enumeration
...

### ECS Enumeration
...

### EKS Enumeration
...

### Container Backdooring
...

### EKS Secrets via RCE
...

## Database Exploitation

This section covers the enumeration and password-based access techniques for Amazon Relational Database Service (RDS).

### RDS Enumeration
...

### Password-Based Access
...

## VPC Enumeration & Lateral Movement

This section outlines the enumeration and lateral movement techniques within a Virtual Private Cloud (VPC) on AWS.

### VPC Enumeration
...

### Route Table Targets
...

### Lateral Movement via VPC Peering
...

## Security Checklist

This checklist provides recommendations for improving the security posture of an AWS environment by addressing Identity and Access Management (IAM), logging, monitoring, and networking concerns.

### Identity and Access Management
- [ ] Avoid use of root account
- [ ] MFA enabled for all IAM users with console access
- [ ] Disable credentials unused for 90+ days
- [ ] Rotate access keys every 90 days
- [ ] Password policy: uppercase, lowercase, symbol, number, 14+ chars
- [ ] No root access keys exist
- [ ] MFA enabled for root account
- [ ] IAM policies attached to groups/roles only

### Logging
- [ ] CloudTrail enabled in all regions
- [ ] CloudTrail log file validation enabled
- [ ] CloudTrail S3 bucket not publicly accessible
- [ ] CloudTrail integrated with CloudWatch Logs
- [ ] AWS Config enabled in all regions
- [ ] CloudTrail logs encrypted with KMS
- [ ] KMS key rotation enabled

### Networking
- [ ] No security groups allow 0.0.0.0/0 to port 22
- [ ] No security groups allow 0.0.0.0/0 to port 3389
- [ ] VPC flow logging enabled
- [ ] Default security group restricts all traffic

### Monitoring
- [ ] Alarm for unauthorized API calls
- [ ] Alarm for console sign-in without MFA
- [ ] Alarm for root account usage
- [ ] Alarm for IAM policy changes
- [ ] Alarm for CloudTrail config changes
- [ ] Alarm for console auth failures
- [ ] Alarm for CMK disabling/deletion
- [ ] Alarm for S3 bucket policy changes
- [ ] Alarm for security group changes
- [ ] Alarm for NACL changes
- [ ] Alarm for VPC changes

[source: skills/aws-penetration-testing/references/advanced-aws-pentesting.md]