Cloud Security Posture Evaluation: AWS Configuration Testing

Prerequisites

• STE-K001: What STE Is
• FND-K004: OS Fundamentals (recommended)

Why This Lesson Matters

Cloud misconfigurations are the leading cause of data breaches in cloud environments. Unlike traditional vulnerabilities, they require no exploit — an attacker simply connects to a publicly accessible resource that should have been private. Evaluating cloud posture means checking configuration decisions, not exploiting code flaws.

1. Cloud Evaluation vs Cloud Penetration Testing

Cloud penetration test: "Can I break into the account or escalate privileges?"
Cloud posture evaluation: "Do the configuration controls meet the security baseline?"

Same AWS environment. Different questions.
STE evaluates controls like:
  - S3 bucket access controls
  - IAM policy least privilege
  - CloudTrail logging completeness
  - Security group rules
  - Encryption at rest and in transit
  - Public access blocks

2. S3 Bucket Evaluation

2.1 Public Access Controls

Control: S3 buckets containing sensitive data shall not be publicly accessible.

Test procedure:
  Step 1: List all buckets in the account
    aws s3 ls (with evaluator credentials — read-only)

  Step 2: Check public access block setting on each bucket
    aws s3api get-public-access-block --bucket BUCKET_NAME
    Expected: all four flags = true
    FAIL: any flag = false

  Step 3: Check bucket policy for Principal: "*"
    aws s3api get-bucket-policy --bucket BUCKET_NAME | jq .
    FAIL: "Principal": "*" with "Effect": "Allow"

  Step 4: Attempt anonymous access (confirms actual exposure)
    curl -I https://BUCKET_NAME.s3.amazonaws.com/   # no auth
    FAIL: HTTP 200 (publicly accessible)

# Automated S3 public access check across all buckets
aws s3api list-buckets --query 'Buckets[].Name' --output text | 
  tr '  ' '
' | while read bucket; do
    block=$(aws s3api get-public-access-block --bucket "$bucket" 2>/dev/null | 
            jq '.PublicAccessBlockConfiguration | to_entries | 
                map(select(.value != true)) | length')
    echo "$bucket: $block flags not set to true"
  done

2.2 Bucket Policy Analysis

// FAIL example — bucket policy with public read
{
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::sensitive-data-bucket/*"
  }]
}
// Principal: "*" = any unauthenticated internet user
// s3:GetObject = download any object in the bucket

3. IAM Policy Evaluation

3.1 Least Privilege Checks

Control: IAM policies shall follow least privilege — granting only
         the permissions required for the role's function.

Red flags to identify:
  "Action": "*"           → full AWS access
  "Resource": "*"         → all resources in all services
  "Effect": "Allow" + iam:* → privilege escalation risk
  No Condition block on cross-account AssumeRole

Automated check:
aws iam list-policies --scope Local --query 'Policies[*].Arn' --output text | 
  tr '  ' '
' | while read arn; do
    policy_doc=$(aws iam get-policy-version 
      --policy-arn "$arn" 
      --version-id $(aws iam get-policy --policy-arn "$arn" 
                     --query 'Policy.DefaultVersionId' --output text) 
      --query 'PolicyVersion.Document' --output json)

    wildcard=$(echo "$policy_doc" | jq '[.Statement[] | 
      select(.Effect=="Allow") | 
      select(.Action=="*" or .Resource=="*")] | length')

    if [ "$wildcard" -gt 0 ]; then
      echo "WILDCARD FOUND: $arn ($wildcard statements)"
    fi
  done

3.2 Service Control Policies (SCPs)

SCPs define what can never be permitted across the entire AWS Organisation:

Control: An SCP shall prevent any member account from disabling CloudTrail logging.

Evaluation:
  Step 1: List SCPs attached to the organisation root
    aws organizations list-policies --filter SERVICE_CONTROL_POLICY

  Step 2: Inspect the SCP for cloudtrail:StopLogging / cloudtrail:DeleteTrail deny
    FAIL: no SCP explicitly denying these actions
    PASS: SCP contains Deny on cloudtrail:StopLogging with NotPrincipal = management account

4. CloudTrail & Logging Evaluation

Control: CloudTrail shall be enabled in all regions with log file validation.

Test procedure:
  aws cloudtrail describe-trails --include-shadow-trails

  Check each trail:
    → MultiRegionTrail: true (covers all regions)
    → LogFileValidationEnabled: true (integrity protection)
    → S3BucketName: not publicly accessible (logs must be private)
    → CloudWatchLogsLogGroupArn: present (logs shipped to CloudWatch)

  FAIL conditions:
    → MultiRegionTrail: false (gaps in coverage)
    → LogFileValidationEnabled: false (tampered logs undetectable)
    → Trail log bucket has public read enabled

5. Security Group Evaluation

Control: Security groups shall not permit unrestricted inbound access (0.0.0.0/0)
         on sensitive ports (22/SSH, 3306/MySQL, 5432/PostgreSQL, 27017/MongoDB).

aws ec2 describe-security-groups --query 
  "SecurityGroups[*].{ID:GroupId,Name:GroupName,Ingress:IpPermissions}" | 
  python3 -c "
import json, sys
sgs = json.load(sys.stdin)
for sg in sgs:
    for rule in sg.get('Ingress', []):
        for ip in rule.get('IpRanges', []):
            if ip.get('CidrIp') == '0.0.0.0/0':
                ports = f"{rule.get('FromPort',0)}-{rule.get('ToPort',65535)}"
                print(f"FINDING: {sg['Name']} ({sg['ID']}): 0.0.0.0/0 on ports {ports}")
"

6. Common Mistakes

Mistake 1: Evaluating configuration without read-only credentials. Cloud posture evaluation requires API access. Read-only IAM credentials (SecurityAudit policy or equivalent) must be provisioned before the engagement — not improvised during testing.

Mistake 2: Only checking S3 buckets and missing other storage services. EBS snapshots, RDS backups, and ECR container images can also be publicly accessible. A complete evaluation checks all data storage services.

Mistake 3: Flagging every non-wildcard policy violation. Some wildcard-adjacent permissions are intentional and documented. Always check the policy's intended use case before flagging. A CI/CD deployment role may legitimately need broad S3 access — the question is whether that access is scoped to the deployment bucket.

7. Practice Exercises

1. aws s3api get-public-access-block returns {"BlockPublicAcls": false, "IgnorePublicAcls": true, "BlockPublicPolicy": false, "RestrictPublicBuckets": true}. Is this bucket protected against public access? Which specific attack vector remains open?

2. An IAM policy contains: "Action": "s3:*", "Resource": "*". Is this a finding? What additional context do you need before classifying severity?

3. Write the STE finding for a security group that allows 0.0.0.0/0 inbound on port 3306. Include: control reference, test procedure description, CVSS score, and remediation.

8. Lab

Assessment mode: flag

challenge_spec_id: 71 — IAM policy misconfig

Task: 1. Review the provided IAM policy JSON 2. Identify the wildcard or misconfigured permission 3. The flag is embedded in the policy's Sid (Statement ID) field

9. Framework Alignment

10. Further Reading

• AWS Security Benchmark (CIS AWS Foundations) — The standard STE evaluation baseline for AWS
• Prowler — https://github.com/prowler-cloud/prowler — Open-source AWS/Azure/GCP security assessment tool
• Steampipe — https://steampipe.io — SQL-based cloud configuration querying

["Check all S3 buckets in an AWS account for public access misconfigurations using the AWS CLI, and classify each bucket as pass, fail, or requires investigation", "Scan IAM policies for wildcard Action or Resource configurations using a Python script and write a finding for each policy that grants overly broad permissions", "Evaluate CloudTrail configuration for multi-region coverage, log file validation, and log bucket privacy, and produce pass/fail results for each criterion"]

Prerequisites → Why this matters → Cloud evaluation vs cloud pentest distinction → S3 bucket evaluation (public access blocks, bucket policy analysis, anonymous access test) → IAM policy evaluation (least privilege checks, SCP evaluation) → CloudTrail and logging evaluation → Security group evaluation → Common mistakes → Practice exercises → Lab (flag, spec 71) → Framework alignment → Further reading