Cloud Pentest (AWS/Azure) — Cheatsheet

AWS — configure & identity

Set your access key, secret, and region.

$aws configure

Confirm which principal your keys belong to.

$aws sts get-caller-identity

AWS — S3

List a bucket's contents (unauthenticated if public).

$aws s3 ls s3://<bucket> --no-sign-request

Download a single object.

$aws s3 cp s3://<bucket>/file . --no-sign-request

Mirror an entire bucket locally.

$aws s3 sync s3://<bucket> ./loot --no-sign-request

AWS — IAM enum

List IAM users in the account.

$aws iam list-users

Show policies attached to a user (find over-privilege).

$aws iam list-attached-user-policies --user-name <u>

List a user's access keys.

$aws iam list-access-keys --user-name <u>

AWS — external recon / Pacu

Find public S3 buckets tied to a keyword/brand.

$cloud_enum -k <keyword>

Launch Pacu and run enumeration modules.

$pacu

Azure / Entra

Log in to Azure.

$az login

Show the current subscription and tenant.

$az account show

List directory users.

$az ad user list -o table

Password-spray Entra/O365 accounts with MSOLSpray.

$python MSOLSpray.py --userlist users.txt --password 'Spring2024!'