srl
AWS Cloud Red Teaming — Operator Notes
Practical field reference for assessing AWS environments from an attacker’s seat. Covers initial access, enumeration, privilege escalation, lateral movement, persistence, impact, detection/evasion, and tooling. The MCRTA chain is used as a worked example in §11.
Authorized engagements only. Assume every API call is logged (CloudTrail); plan the detection story before the action, not after. AWS environments are heavily monitored by GuardDuty, Security Hub, and third-party EDRs. Move slowly, reuse existing artifacts, and understand the IP/User-Agent footprint you are leaving behind.
2025–2026 update: The attack surface has expanded dramatically. Bedrock AgentCore and Cognito are new privilege-escalation primitives. AI-assisted intrusion reached admin access in 8 minutes (Sysdig, Nov 2025). pathfinding.cloud catalogs 65+ verified IAM escalation paths and pathrunner automates them. Hostname obfuscation (nip.io, sslip.io, 1u.ms) bypasses IP blocklists for SSRF. AWS Config delivery-channel redirection and PutAlternateContact are stealthy persistence mechanisms. CloudFox v1.17.0+ is required after AWS changed its service-mapping format in Dec 2025.