Cloud Security Testing

Notes and references for testing the security of cloud environments (AWS, Azure, GCP): identity and access, storage exposure, network paths, and control-plane misconfigurations. Start from the provider's own security guidance and a benchmark (CIS), then use the tooling below to enumerate and validate.

HackTricks Cloud - HackTricks CloudHackTricks Cloud

Tooling

• Prowler - multi-cloud security assessments (AWS, Azure, GCP, Kubernetes)

• ScoutSuite - multi-cloud security auditing

• CloudFox - find exploitable attack paths in cloud infrastructure

• Pacu - AWS exploitation framework

• PMapper - AWS IAM privilege-escalation path analysis

• stratus-red-team - emulate cloud attack techniques for detection testing

• ROADtools - Azure AD (Entra ID) enumeration

Provider references

• AWS Well-Architected: Security Pillar

• Microsoft Cloud Security Benchmark

• Google Cloud security best practices center

• CIS Benchmarks