performing-cloud-penetration-testing-with-pacu

Run iam__enum_permissions first to collect the principal's effective permissions, then run iam__privesc_scan to test 21+ escalation methods including PassRole combinations. Confirm any hit by performing the gated action with the escalated credentials rather than trusting scanner output alone.

Use Pacu's iam__enum_users_roles_policies_groups and iam__enum_permissions modules after setting session keys with set_keys. Watch for AccessDenied errors on iam:GetAccountAuthorizationDetails, since gaps there cause the privilege escalation scanner to report false negatives.

The scanner only reasons over permissions already collected, so incomplete enumeration hides real paths. Ensure iam__enum_permissions completed without AccessDenied gaps, run set_regions all, map PassRole target roles with iam__enum_roles, and review resource-based policies on S3, KMS, and Lambda.

Yes, Pacu modules generate many API calls and commonly trigger findings such as Recon:IAMUser/MaliciousIPCaller. Coordinate with the SOC to whitelist testing IPs or establish communication channels, and use the engagement to measure detection and response times.

Do not use Pacu without written authorization from the account owner, against AWS infrastructure itself which is covered by shared responsibility, or for DDoS-style volumetric attacks without AWS approval. Production accounts require explicit authorization and documented breakglass procedures.