Cloud Penetration Testing for AWS, Azure & GCP

Cloud penetration testing is a security assessment of your AWS, Azure, or GCP environment that identifies IAM misconfigurations, privilege escalation paths, storage exposure, network segmentation gaps, and container/Kubernetes security issues.

We perform greybox testing with read-only or limited-privilege credentials. This simulates a realistic attacker scenario: gaining initial access and attempting to escalate privileges.

An AWS pentest scope at Cybersecify covers six layers in 5 to 10 business days. IAM (roles, policies, trust relationships, unused credentials, MFA gaps, root account hygiene), S3 (public buckets, bucket policy vs ACL conflicts, presigned URL abuse, cross-account access), EC2 and VPC (security group ingress rules, NACLs, peering misconfigurations, public AMIs, IMDSv1 metadata theft), EKS (pod security, privileged containers, RBAC, secrets in env vars, workload identity), Lambda (overprivileged execution roles, env-var secrets, function URL exposure), and supporting services (RDS public access, KMS key policies, Secrets Manager rotation, CloudTrail coverage). Out of scope: AWS-managed infrastructure (shared responsibility model) and active denial-of-service against AWS production services per AWS pentest policy.

Azure pentest covers the same six attack-surface layers but with Azure-specific tools and primitives. Azure AD and Entra ID (conditional access policy gaps, app registration secrets, service principal sprawl, guest user privilege escalation), Blob storage (anonymous read, SAS token abuse, lifecycle policy gaps), VNet and NSG (overly permissive inbound rules, hub-spoke topology gaps), AKS (pod security policies, Azure RBAC vs Kubernetes RBAC mismatches), Functions (managed identity overreach, key vault references), and supporting services (Key Vault access policies, Storage Account firewall, App Service authentication, Defender for Cloud findings triage). Microsoft Graph API is tested for over-permissioned app registrations. Out of scope: Azure-managed infrastructure, and anything the Microsoft Security Testing Rules of Engagement prohibits, which includes denial-of-service testing, phishing and social engineering, and post-compromise actions such as lateral movement, dumping secrets or pivoting. Microsoft does not require you to notify it before testing your own tenant, and testing must stay inside assets you own or are explicitly authorised for (checked 2026-08-15).

GCP pentest at Cybersecify covers IAM (resource-hierarchy inheritance, role-binding sprawl, custom-role over-permission, service account key abuse, organization policy gaps), Cloud Storage (allUsers and allAuthenticatedUsers exposure, signed URL leakage, uniform-bucket-level access bypass), GKE (workload identity binding gaps, node service-account scope, private cluster verification, Binary Authorization bypass), Cloud Run and Cloud Functions (ingress and authentication settings, IAM invoker scope, env-var secrets), VPC and firewall (default-allow rules, peering, Cloud NAT egress), BigQuery (dataset ACLs, row-level security bypass, authorized view scope), and supporting services (KMS key policies, Secret Manager rotation, Cloud Logging coverage). GCP-specific finding: organizations leaving the default service account with editor role on every Compute Engine instance is the most common privilege escalation we surface.

Yes. Kubernetes pentest is a standard part of any cloud engagement that runs containers in production. We test pod security (containers running as root, privileged mode, host network or PID namespace access, hostPath volume mounts), service account token mounts (default token automount, overpermissioned token scope), RBAC (cluster-admin bindings on service accounts that should not have them, role aggregation gaps), network policy enforcement (default-allow vs default-deny posture), admission controllers (PodSecurityPolicy or Pod Security Admission gaps, OPA Gatekeeper bypass), secrets handling (etcd encryption, sealed secrets, External Secrets Operator scope), and container escape paths (CVE patch status, runc and containerd version pinning).

IAM privilege escalation testing is the highest-severity layer in any cloud pentest because one mispermissioned role typically chains to full account compromise. We start with limited credentials (simulating a compromised developer laptop or leaked API key) and map every path to higher privileges. Specific tests: can this role create a new admin user, can this role attach a more permissive policy to itself, can this Lambda function assume a more privileged role, can this user create access keys for higher-privileged users, can this role manipulate IAM policies via service-specific APIs (PassRole abuse, iam:CreateLoginProfile, sts:AssumeRole chain depth). We use Pacu for AWS, PowerZure for Azure, and custom GCP scripts. Findings document the full attack chain, not the individual misconfigurations.

A single-scope cloud pentest at Cybersecify takes 5 business days under the Startup Pentest plan at INR 74,999 and covers one cloud environment (AWS account, Azure subscription, or GCP project). A two-scope engagement (typically cloud plus web app or cloud plus API) takes 10 business days under the Growth Pentest plan at INR 1,79,999 and includes SOC 2 + ISO 27001 audit-prep evidence with control mapping per finding. Multi-account, multi-cloud, or large estate (50+ services, multiple production environments) goes beyond standard scope and requires scoped proposal. All cloud pentests include 1 free retest within one month of report delivery.

Yes. Cloud pentest reports follow PTES, OWASP Cloud-Native Application Security Top 10, and CIS Benchmarks for the relevant cloud provider (CIS AWS Foundations Benchmark, CIS Azure Benchmark, CIS GCP Benchmark). Reports produce technical + executive summaries with reproduction steps, business impact in plain language, CVSS v3.1 scoring, and remediation guidance specific to your cloud provider. The Growth Pentest plan adds explicit SOC 2 Trust Services Criteria (CC6.6 Protection Against External Threats, CC6.8 Controls Against Unauthorized or Malicious Software, CC7.1 Vulnerability Detection, CC7.2 Anomaly Monitoring) + ISO 27001 Annex A control mapping per finding (A.8.8 Management of technical vulnerabilities, A.5.23 Information security for cloud services, A.8.20 Network security).

Cloud configuration audit (CSPM tools like Wiz, Lacework, Prisma Cloud, Orca) runs rule-based checks against your cloud account and produces a list of misconfigurations against published benchmarks. Cloud pentest simulates what an attacker would do after gaining initial access: chains misconfigurations into privilege escalation paths, verifies actual exploitability of findings, and tests business logic specific to your environment. CSPM tells you you have a publicly readable S3 bucket. Cloud pentest tells you that bucket contains production database backups, the bucket policy allows cross-account read from a third-party AWS account, and an attacker with any IAM foothold can enumerate it in seconds. Both are useful; they answer different questions. Most SaaS startups need CSPM for continuous configuration monitoring and pentest annually for adversarial validation.