skills.rest
jcastillotx
jcastillotxCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

AWS Penetration Testing

Assess AWS environments with IAM enumeration, privilege escalation, and S3 testing.

Updated Jan 12, 2026
Search Tags:#security#aws#iam#s3#pentesting#lambda#ssrf
One-click install
npx skills add https://github.com/jcastillotx/vibe-skeleton-app --skill aws-penetration-testing-jcastillotx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: AWS Penetration Testing
Source: https://github.com/jcastillotx/vibe-skeleton-app/tree/main/setup/skills/aws-penetration-testing
Command: npx skills add https://github.com/jcastillotx/vibe-skeleton-app --skill aws-penetration-testing-jcastillotx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

AWS security assessments are complex and require specialized knowledge and tooling. This skill consolidates proven techniques, workflows, and references to help security professionals identify IAM misconfigurations, privilege escalation vectors, SSRF to metadata, S3 bucket exposure, and Lambda-related risks.

Core Features & Use Cases

  • IAM enumeration and privilege escalation guidance
  • SSRF to instance metadata, S3 bucket testing, Lambda exposure
  • Red-team style persistence and audit findings generation
  • Use Case: simulate an enterprise-grade AWS security assessment with scope and reporting

Quick Start

Ensure AWS CLI is configured with valid credentials, install Python 3 with boto3, and have tools such as Pacu, Prowler, ScoutSuite, and SkyArk ready. Then follow the Core Workflow in the references for practical steps.

Frequently Asked Questions about AWS Penetration Testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform IAM enumeration and privilege escalation testing in AWS?▼

AWS IAM enumeration and privilege escalation testing involves identifying misconfigured permissions and roles to map exploitable access paths. This skill guides targeted techniques to simulate enterprise-grade security assessments and uncover identity-based vulnerabilities.

What is SSRF to instance metadata and how does it expose AWS resources?▼

SSRF to instance metadata exploits Server-Side Request Forgery vulnerabilities to access the Instance Metadata Service (IMDS), potentially leaking temporary AWS credentials. This skill provides guidance on assessing SSRF vectors targeting IMDS endpoints.

What's the best way to test S3 buckets for exposure during a pentest?▼

Testing S3 buckets for exposure requires evaluating bucket policies, ACLs, and public access configurations to identify data leakage risks. This skill consolidates proven workflows to help security professionals assess S3 bucket security within AWS environments.

Do I need specific tools and credentials to run an AWS pentest assessment?▼

AWS pentest assessments require configured AWS CLI credentials, Python 3 with boto3, and specialized tools like Pacu, Prowler, ScoutSuite, and SkyArk. This skill necessitates these prerequisites to effectively guide IAM enumeration, S3 testing, and Lambda code access evaluations.

Can I simulate red-team persistence techniques in an AWS environment?▼

Red-team persistence techniques in AWS involve maintaining unauthorized access through IAM roles, Lambda functions, or other services. This skill provides guidance on simulating enterprise-grade red-team assessments, including persistence and audit findings generation.

Related Skills

Explore More Software Engineering Skills→
LaurentPRAT-DBLaurentPRAT-DB

aws-authentication

Validate AWS CLI credentials and perform SSO login using named profiles.

Community
Basic
YukiIto1999YukiIto1999

performing-gcp-penetration-testing-with-gcpbucketbrute

Enumerate GCS buckets, audit IAM bindings, and review service account keys.

Community
Advanced
zebbernzebbern
4.5k

AWS Penetration Testing

Enumerate AWS IAM misconfigurations and privilege escalation paths.

Community
Advanced
LerianStudioLerianStudio
205

ops-security-audit

Automate infrastructure security audits with phased scanning and compliance mapping.

Official
Advanced