AWS Penetration Testing: A DIY Guide for Beginners

Over a million people across 190 countries use Amazon Web Services (AWS) to build and deploy different types of applications, store and manage valuable data, and use a wide range of other services. As the leading cloud service provider, AWS has rid its customers of a lot of hardships – the need for on-premise data warehouses, distributed computing systems, and cumbersome hardware management – but cyber security threats are not among them. Hence, it is important that we discuss AWS penetration testing.

AWS has its own automated as well as manual security controls for applications and platforms. However, it is hard to get around the lack of security visibility given the number of cloud applications businesses often use on top of AWS. Add to that the increasing complexity of compliance mandates, data processing, and use cases while migrating to (or while scaling on) AWS, and the struggle for companies trying to strengthen data security for themselves and their customers intensifies.

A detailed vulnerability assessment and penetration testing (pen-testing) for their implemented AWS infrastructure solutions can help companies identify and tackle security vulnerabilities, and ensure a robust security framework for protecting their online assets from cyber-criminals. 

Why Astra is the best in pentesting?

• We’re the only company that combines automated & manual pentest to create a one-of-a-kind pentest platform
• Vetted scans ensure zero false positives
• Our intelligent vulnerability scanner emulates hacker behavior & evolves with every pentest
• Astra’s scanner helps you shift left by integrating with your CI/CD
• Our platform helps you uncover, manage & fix vulnerabilities in one place
• Trusted by the brands you trust like Agora, Spicejet, Muthoot, Dream11, etc.

Let’s talk

Get started

What is Penetration Testing in AWS?

A typical AWS penetration test involves a team of skilled penetration testers who test your AWS infrastructure for vulnerabilities that hackers might exploit. Upon completion of the pentest, a detailed report constituting the areas of weaknesses and the course of action to fix them are also mentioned. 

However, the traditional practices of penetration testing services are little likely to comply with the policies of AWS. AWS’s core infrastructure is owned by Amazon and the methodologies used for AWS pentesting are subject to their policies.

There are broadly four key areas to focus on for penetration testing of AWS:

• External Infrastructure of your AWS cloud
• Application(s) you are hosting/building on your platform
• Internal Infrastructure of your AWS cloud
• AWS configuration review

Read Also: Cloud Penetration Testing | Penetration Testing Quote

Does AWS allow penetration testing?

Yes, AWS allows penetration testing, however, there are specific boundaries to what an ethical hacker can play with while the rest remains out of bounds for pen-testing.

The services that can be tested without prior approval include: 

1. Amazon EC2 instances
2. Amazon RDS
3. Amazon CloudFront
4. Amazon Aurora
5. Amazon API Gateways
6. AWS Fargate
7. AWS Lambda
8. AWS LightSail resources
9. Amazong Elastic Beanstalk environments

For User-Operated services that include cloud offerings and are configured by users, AWS permits an organization to fully test their AWS EC2 instance while excluding tasks related to disruption of continuity. 

For Vendor Operated services (cloud offerings that are managed and configured by 1 third-party), AWS restricts the pentesting to configuration and implementation of cloud environment excluding the underlying infrastructure.

Let us talk some more about it.

What Pen-Testing can be performed in AWS?

AWS allows the pen testing of specific areas of EC2 (Elastic Cloud Computing), they are:

• API, i.e; Application Programming Interface
• Web applications hosted by your organization
• Programming languages
• Virtual machines and Operating systems

What are the off-limits for AWS penetration testing?

The parts of AWS cloud that can not undergo pentest because of legal restrictions are as follows:

• Servers belonging to AWS
• Physical hardware, facility, or underlying infrastructure that belongs to AWS
• EC2 belonging to other vendors
• Amazon’s small Relational Database Service (RDS)
• Security appliances managed by other vendors

Related blog – Detailed Sample Penetration Testing Report | Top 6 Web Pentest Tools You Should Not Miss

By now you are familiar with the conditions governing AWS penetration testing, and ready to jump deeper. Well done!

Types of AWS Penetration Testing

We can categorize the security testing of an AWS platform into two parts:

1. Security of Cloud

The security of the Cloud is the security responsibility of Amazon (AWS) to make sure their cloud platform is secured against any possible vulnerabilities and cyber attacks for the companies that are using any AWS services. The security of the cloud includes all the zero days and logic flaws that can be exploited at any step to disrupt the performance of an AWS server/s.

Related Read: Cloud Security Audit: Everything You Need to Know

2. Security in Cloud

Security in the cloud is the responsibility of the user/company to make sure their deployed applications/assets on AWS infrastructure are secured against any kind of cyberattacks. A user/company can enhance the security of their applications on the AWS cloud by implementing necessary security practices.

Read Also: A Complete Guide to Cloud Security Testing

Difference between traditional penetration testing and AWS penetration testing

We have already established that pentesting in AWS differs from traditional pentesting in terms of approach and methodologies. How about a closer look?

In a traditional pentest for a web application that you own, you can have a free hand. When it comes to AWS penetration testing the internal and external infrastructure of the AWS cloud, Identity, and access management, and AWS configuration and permissions become governing factors.

List of AWS controls to be tested for security

Here is the list of Amazon Web Services controls that can be and need to be tested for security. In brief, it includes testing the body of governance like the access policies, network management, encryption, and monitoring of assets. 

a. Governance:

• Identify assets & define AWS boundaries
• Access Policies
• Identify, review & evaluate risks
• Add AWS to risk assessment
• IT security & program policy

b. Network Management

• Network Security Controls
• Physical links
• Granting & revoking accesses
• Environment Isolation
• DDoS layered defense
• Malicious code controls

c. Encryption Control

• AWS Console access
• AWS API access
• IPSec Tunnels
• SSL Key Management
• Protect PINs at rest

d. Logging and Monitoring

• Centralized log storage
• Review policies for ‘adequacy’
• Review Identity and Access Management (IAM) credentials report
• Aggregate from multiple sources
• Intrusion detection & response

Related Guide – How to conduct Website Penetration testing | Top 5 Software Security Testing Tools in 2022 [Reviewed]

Steps to take before performing AWS Penetration Testing

1. Define the scope of the penetration test including the target systems.
2. Run your own preliminary i.e. run vulnerability scanners like AWS Inspector or Astra’s vulnerability scanner to find basic vulnerabilities before the in-depth analysis. 
3. Define the type of security test you will conduct.
4. Outline the expectations for both the stakeholders and the penetration testing company (if outsourced).
5. Establish a timeline to manage the technical assessment.
6. Define a set of protocols in case the test reveals that security has already been breached.
7. Obtain the written approval of the related parties to perform a pen test.

Now, you are ready to jump right into the thick of things.

How to perform Penetration Testing on AWS?

 Identity and Access Management (IAM)

The first and most important step in the process of penetration testing is to identify the assets of data stores and applications. Some important points to keep in mind during asset identification are:

• Removal of keys from the root account
• Implement two-factor authentication
• Do not use the root account for daily tasks or automation
• Restrict the permission to service accounts
• Limit the use of one key per user
• Regularly change SSH and PGP keys
• Delete inactive security accounts

2. Logical Access Control

The next step to follow after the identification of assets is to manage the access control on the cloud. It is a process of assigning different actions to the resource. The main process of Logical Access Control involves controlling access to resources, processes, and users of AWS. Credentials related to the AWS accounts must be safe and secure.

3. S3 Buckets

S3 is a cloud folder generally known as a “Bucket”. It is a storage server that delivers region exceptions, access logging, versioning, encryption, access logging, etc. Here are two important things you must ensure to maintain the security of the S3 buckets:

• Permissions (such as GET, PUT, DELETE, LIST for HTTP methods) should be restricted to certain users
• The logging and versioning of the bucket should be enabled.

4. Database Service

The database is an important part of most web services. It is important to follow the necessary steps to secure the database of your application. The key points to keep in mind while performing a security audit are:

• Use the Multi-AZ deployment method.
• Limit access to specified IP addresses.

Tools used in AWS Testing

There are many tools that you can use to pentest your AWS integrated services. Different sets of tools are available to carry out different types of tests. Here are some of them:

• AWS Inspector: This service by AWS helps in the automation of vulnerability management through immediate scanning of AWS workloads to detect software vulnerabilities and exposure. 
• AWS Security Hub: This is a tool designed by AWS to automate security checks and centralize security alerts within the platform. It is concerned with security posture management across all accounts and regions. 
• Astra Security Scan: It is a cloud infrastructure security testing tool that allows you to pentest your AWS services and look for potential vulnerabilities. It offers an interactive dashboard where you can monitor the audit trail and see the detailed analysis for each discovered vulnerability along with the recommended steps to fix those vulnerabilities. This dynamic dashboard thing sets this particular tool aside, as you can see and fix the vulnerabilities as they are found, instead of waiting for the audit to end. You can also integrate your pentest project with GitHub, GitLab, and Jira. It also allows you to start automatic pentest with every feature update.
• Prowler: It is an open-source security testing tool that allows you to scan your AWS account for potential vulnerabilities, IAM permissions, and compliance on the basis of a set of standard benchmarks such as the AWS Foundations Benchmark.
• CloudSploit: It is a cloud security auditing and monitoring tool that allows you to audit the configuration state of services in your AWS account. It checks for publicly exposed servers, unencrypted data storage, lack of least-privilege policies, misconfigured backup, restore settings and data exposure, and privilege escalation.
• Cloudsplaining: It is an open-source tool for AWS IAM security assessment that allows you to identify violations of least privilege and generate a risk-prioritized report for evaluation.

Also Read: 11 Best Penetration Testing Tools & Platforms of 2022

AWS Penetration Testing Provider – Astra Security

As you would have gathered by now, AWS penetration testing is a serious undertaking involving complex processes and requiring specific knowledge. Performing a complete security audit by yourself for the first time can be difficult. But you don’t have to worry. Astra is here to help you out. 

Astra Security is a cyber-security company that performs a complete security audit of your application. We are a group of security experts that can provide an in-depth analysis of your AWS system. See our AWS Security Audit Program.

Conclusion

Amazon Web Services (AWS) offers various integration opportunities to your application with some in-built security features for the security of the cloud. But the security in the cloud resides completely in your hands. Henceforth, performing penetration testing becomes more and more important every day for your business. You can go through the above guide to do it yourself. Or you can also take professional help from Astra Security.

If you have further queries on AWS penetration testing by Astra Security, chat with us with the chat widget. You can also contact us by dropping comments in the comment box and we will be happy to help you!

FAQs

Share this...

Facebook

Pinterest

Twitter

Linkedin