Mastering Cloud Penetration Testing

Cloud environments, while designed for flexibility and scale, present a complex, ever-widening target for security professionals. Effective cloud penetration testing (pen testing) requires a blend of traditional security skills, deep service-specific knowledge, and the right modular tools to navigate complex Identity and Access Management (IAM) structures and pivot from external access to internal cloud environments.

We spoke with Scott Weston, a Senior Consultant at NetSpl with experience in AWS and GCP pen testing, about his newly open-sourced tool, GCPawn, the necessary skills for cloud security, and the move toward continuous testing.

You can read the complete transcript of the epiosde here >

What is GCPawn, and How Does It Help GCP Penetration Testers?

GCPawn (pronounced G-C-Pawn) is designed to be a “Swiss army knife for GCP pen testing,” modeled after the modularity of the AWS pen testing tool Pacu.

Core Functionality

The tool focuses on enumeration, exploitation, and, most importantly, credential management.

• Enumeration and Data Download: It enumerates resources in a GCP account and can download data. For example, it can list all GCP buckets and download all the data within them to a local file for sifting.
• Exploitation: It bundles multiple API calls into a single module, streamlining exploitation efforts.
• Credential Management: This is considered the coolest feature. A user can load multiple credentials—Service Account Creds, OAuth Creds, email/password—all at once and swap between them as needed.
• Passive Permission Tracking: As the user actively runs modules and successfully calls GCP APIs (e.g., enumerating buckets), GCPawn tracks the permissions in the background, providing a summary of the credentials’ capabilities at the end. This allows testers to determine exactly what permissions they have.

Intended Use Case

GCPawn is intended as a starting point for enumeration and lateral movement after a pen tester gains a foothold (e.g., finding exposed GCP credentials or an OAuth token during a web or external network test). It is not meant to replace full configuration review tools like Scout Suite.

Roadmap for Growth

The goal is to make GCPawn community driven by publishing a wiki on how to make pull requests and add new modules. Current service additions on the roadmap include Cloud Run, Firebase, and Redis memory cache.

What is the Shared Responsibility Model, and Why is It Critical for Pen Testers?

The Shared Responsibility Model is an agreement between the cloud provider and the customer that dictates security ownership.

• Provider Responsibility (Security of the Cloud): The cloud provider manages things outside the customer’s control, such as maintaining physical infrastructure, server uptime, and the underlying physical boxes.
• Customer Responsibility (Security in the Cloud): The customer is responsible for building things securely within the “sandbox” the provider gives them. If a customer writes insecure code for a Lambda function, exposes an API key, or sets up services insecurely, the cloud provider cannot do much about it.

The Pen Tester’s Insight: Security faults can and do pop up on both sides of the shared model, though they occur less frequently on the provider side.

What Core Skills are Essential for Cloud Penetration Testing?

Cloud pen testing requires a “pot of different security skills” because different cloud services demand different testing approaches (e.g., EC2 involves IP management, Lambda involves secure code review).

• IAM (Identity and Access Management): This is the most important area to master, as almost everything in all cloud providers sits on IAM. Learning IAM first makes it easier to pick up other services, as you only need to understand the core functionality, with IAM controls providing the main complexity (e.g., who accesses the S3 bucket and how).
• Networking: This is probably the second most important, ensuring that assets are exposed only as expected (e.g., an internal private website is not exposed to an external IP).
• The Soft Skill: The key competence is the soft skill of being able to pick things up quickly—Google things, read cloud documentation, and connect the dots—because the environment is constantly changing.

How Can Organizations Move Beyond Annual Penetration Tests?

Annual or quarterly pen tests, often done to meet compliance minimums (e.g., SOC2, HIPAA, PCI), are a good start but are generally not enough.

• Set a Higher Minimum: An organization’s minimum security standard should be higher than external regulations to ensure assets are properly protected.
• The Snapshot Problem: A snapshot pen test (e.g., in June) can miss a critical vulnerability (e.g., an accidentally published API key in July). This can leave the organization exposed for an entire year.
• Continuous Testing Model: The natural next step is adopting a continuous pen testing model via:
  • CSPM (Cloud Security Posture Management) solutions.
  • Attack Surface Management (ASM).
  • This continuous model helps prevent the organization from being flooded with vulnerabilities all at once.
• Red Teaming (The Final Step): Once controls are in place, Red Teaming becomes the final step. The question shifts from do you have vulnerabilities to can you catch someone trying to exploit them in real-time.

What are the Most Common and Critical Cloud Misconfigurations?

Cloud misconfigurations are the root of many security mishaps. Pen testers target several key areas:

IAM Permissions

• Overly permissive policies with wildcard permissions * for resources or actions27.
• Replace * with specific API actions, even if it’s a long list (e.g., listing all 20 S3 actions). This helps reduce the attack surface because you inevitably remove an action the user doesn’t truly need. Apply the same principle to resources (e.g., list two or three specific Lambda functions instead of *.

Secrets Management

• Secrets stored in publicly available resources or in clear text where they should be in the cloud provider’s secrets manager.
• Don’t put secrets in Lambda source code or CloudWatch logs.

Service Configuration

• Using deprecated OS versions, vulnerable external assets, or disabling checks like IMDSv2
• Use automated tools (like Scout Suite) to check for these flags or settings organization-wide.

Human Element

• Context-dependent issues that automated scanners miss.
• An unauthenticated Cognito role that, while technically granular, allows anonymous users to download all Lambda code. The human element asks: Why are you allowing everyone to download your Lambda code?

How Should a Beginner Start Learning Cloud Pen Testing?

• Focus on One Platform: Start by focusing on one cloud provider instead of trying to learn all of them. While Scott usually leans toward AWS, he advises learning the provider your company uses because you can ask colleagues for help and see features firsthand, which reinforces the concepts.
• Start with IAM: Always start by mastering IAM. Once IAM is understood, learning other services becomes easier because you only need to understand the core functionality of the service itself.
• Hands-On Learning Lab:
  • Set Up: Create a personal account (not tied to your company’s production environment) and keep it totally segmented.
  • Practice: Use hands-on platforms like PwnedLabs (simulates a Hack The Box environment for cloud) and Cloud Foxable (a Jeopardy CTF style platform).
  • Test: Create a test environment, learn the service (e.g., GCP Cloud Storage) by reading documentation, and then physically click the buttons to test what you learned.
  • Tear Down: Tear things down at the end to avoid getting billed or compromised. Use test data (like a document that says “test”) instead of actual secrets.
• Tools: Use tools like Scout Suite (good for configuration review) and Pacu/GCPawn (good for pivoting and credential exploitation).

How Can Security Professionals Avoid Stress and Burnout?

The security industry, with its continuous learning demands, leads to high burnout rates.

• Defined Work-Life Balance: The general strategy is to cut off the workday right at eight hours because “whatever you’re looking at can usually wait till tomorrow”.
• Conscious Choice: If you look at security issues after business hours, it should be because you want to look at it (e.g., chasing down an SQL injection for fun), not because you feel obligated.
• Cognizance: Be cognizant of the stress and proactively strive for a defined work-life balance.

Conclusion: The Path to Cloud Mastery

Cloud pen testing mastery is achieved through a technical yet pragmatic approach. It begins with establishing a strong IAM foundation and developing the soft skill of rapid service comprehension. By moving beyond mere compliance checks, adopting a continuous testing model, and leveraging modular tools like GCPawn to expose critical misconfigurations (especially overly permissive IAM and exposed secrets), organizations can build a more secure cloud environment. Ultimately, the key is structured, hands-on learning within a segmented lab environment, always remembering that the security professional’s job is to apply the human element where scanners fail.