# Cloud Penetration Testing

> Use when testing cloud infrastructure security.

- Skill: `loopyluci/cloud-penetration-testing` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/cloud-penetration-testing`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/cloud-penetration-testing/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/cloud-penetration-testing

---


# Cloud Penetration Testing

Testing cloud infrastructure security — from AWS/Azure/GCP IAM enumeration through S3 bucket to privilege escalation, metadata service, and container escape.

## When to Use

- Assessing cloud infrastructure security posture
- Testing cloud IAM policies for privilege escalation
- Auditing cloud storage (S3, Blob, GCS) configuration
- Cloud metadata service exploitation
- Container escape within cloud environments

## Cloud Attack Techniques

```python
CLOUD_ATTACKS = {
    'iam_enumeration': 'Enumerate IAM permissions, users, roles, policies via CLI or API',
    's3_bucket': 'List bucket contents, upload/download, ACL misconfiguration, public access',
    'metadata_service': 'Query http://169.254.169.254/latest/meta-data/ for instance creds',
    'lambda_injection': 'Exploit event injection into Lambda functions for privilege escalation',
    'cloudtrail_logs': 'Disable or modify logging to cover tracks (cloudtrail:StopLogging)',
    'kms_key_abuse': 'Decrypt data using misconfigured KMS key policies',
    'privilege_escalation': 'iam:PassRole, iam:CreatePolicyVersion, ec2:RunInstances with admin role',
}

# AWS metadata service attacks
AWS_METADATA_QUERY = [
    "curl http://169.254.169.254/latest/meta-data/iam/security-credentials/",
    "curl http://169.254.169.254/latest/user-data/",
    "curl http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE]/",
]

# GCP metadata
GCP_METADATA = "curl -H 'Metadata-Flavor: Google' http://169.254.169.254/computeMetadata/v1/"

# Azure IMDS
AZURE_IMDS = "curl -H 'Metadata: true' http://169.254.169.254/metadata/instance?api-version=2021-02-01"
```

## Verification Checklist

- [ ] IAM policy enumeration (users, roles, policies, trust relationships)
- [ ] Privilege escalation paths identified (iam:PassRole, etc.)
- [ ] Storage services audited (S3, Blob, GCS — ACLs, public access)
- [ ] Metadata service accessible (if running in cloud)
- [ ] CloudTrail/CloudWatch logs checked for sensitive data
- [ ] Lambda/Cloud Functions checked for secrets in env vars
- [ ] KMS keys checked for overly permissive policies
- [ ] VPC security groups reviewed for overly broad rules
- [ ] Container images scanned for vulnerabilities