Cloud infrastructure penetration testing (AWS, Azure, GCP)

Most cloud incidents come from a misconfiguration, not a zero-day: the NSA and CISA warn that attackers actively target misconfigured, unsecured or unmonitored cloud systems. We audit your cloud infrastructure before an attacker exploits it.

Scope your project · Request a cloud assessment

Rather talk it through? Call us at +34 960 730 013

Why does the cloud need a different pentest?

The cloud's shared responsibility model puts the security of configuration, identity and data in the customer's hands. A public S3 bucket, an IAM role with excessive permissions or an EC2 instance with hardcoded credentials are vectors that automated scanners don't contextualize. You need a team that thinks like an attacker with deep knowledge of AWS, Azure and GCP.

Scope

  • IAM policy review and privilege escalation in AWS/Azure/GCP
  • Detection of public S3 buckets, Azure blobs and GCS with sensitive data
  • Enumeration of exposed resources: APIs, serverless functions, databases
  • Network assessment: VPC, security groups, Network ACLs, peering
  • Secrets and credentials in instance metadata, environment variables and code
  • Kubernetes assessment (EKS, AKS, GKE): RBAC, pod security, network policies
  • Review of CI/CD pipelines and container registries
  • Alignment with CIS Benchmarks for AWS, Azure and GCP
  • Assessment against the MITRE ATT&CK Cloud Matrix

Methodology

  1. Reconnaissance and enumeration: Enumeration of all cloud resources via APIs, specialized tools (Pacu, ScoutSuite, Prowler) and manual analysis.
  2. IAM and privilege analysis: We map all roles, policies and privilege escalation paths to determine the blast radius of a compromised account.
  3. Configuration exploitation: We exploit the misconfigurations found in a controlled way to demonstrate real impact: data access, lateral movement or full account control.
  4. Secrets and data exposure analysis: We look for exposed credentials in metadata, code, pipelines and backups.
  5. Report and remediation: Severity classification mapped to CIS Benchmarks. Remediation plan prioritized by impact and effort.

Deliverables

  • Executive report with a cloud risk map
  • Technical report with evidence and PoC for each finding
  • Mapping of findings to CIS Benchmarks and MITRE ATT&CK Cloud
  • Hardening guide per cloud service (IAM, S3, EC2, Lambda...)
  • Security posture score before/after
  • Retest included after remediation

Use cases

  • Cloud-native startups on AWS or Azure that need to prove their security to enterprise clients
  • Companies migrating on-premises infrastructure to the cloud for the first time
  • SaaS platforms with a multi-tenant architecture in the public cloud
  • Companies with Kubernetes in the cloud that suspect misconfigurations
  • Organizations subject to NIS2, ENS or ISO 27001 with cloud workloads

Frequently asked questions

Do you need admin credentials for cloud pentesting?

For a complete test, yes, we need an account with read permissions over all services. We can also perform a black-box test from the internet to assess external exposure. We recommend combining both approaches.

Can pentesting affect my production services?

We coordinate all tests to minimize impact. Destructive exploitation (deletion, data modification) always requires explicit approval and is done in test environments.

Do you cover multi-cloud architectures?

Yes. We have experience in environments combining AWS, Azure and GCP, as well as hybrid cloud + on-premises configurations.

What permissions do you need on our cloud account?

A read-only role over the configuration is enough for the review part: in AWS that maps to SecurityAudit or ViewOnlyAccess, with equivalents in Azure and GCP. For the offensive part — checking whether a specific identity can escalate privileges — a test identity with deliberately limited permissions is also needed, and it is precisely the one that demonstrates how far somebody compromising a low-privilege account can get.

Do we need to notify the cloud provider before testing?

The major providers now allow most testing against your own resources without prior authorization, but they keep exceptions — mainly denial-of-service and saturation testing — that do require permission or are outright prohibited. We review the provider's current policy when defining scope and put in writing what is in and what is out, because those policies change.

Does this replace the cloud security posture tools we already have?

No, it complements them. A posture tool tells you which configurations deviate from a baseline, and it does that better and continuously. What it does not do is chain findings: check whether that specific configuration, combined with that role and that function without a private network, lets an attacker get from a public bucket to production credentials. The value of the exercise is in the chain, not in the isolated finding.

Related resources

Sources

Ready to protect your business?

Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.

Scope your project · Request a cloud assessment