AWS IAM Initial Access

In this room, you will learn about several different vectors for attackers to gain initial access to an AWS environment. Now, it is important to establish at the outset what we mean by "initial access" in AWS, and in other cloud providers. Commonly, "initial access" is associated with compromising a computer system. It is also commonly associated with compromising user credentials.

In the case of AWS, it is this second association that we are going to examine. While there are some peculiarities to systems deployed in AWS that attackers want to be aware of (No ARP Requests? (opens in new tab)), the primary mechanism of access in AWS is the credentials associated with the AWS IAM service. Compromising those credentials, or the systems that contain them, are THE method of accessing AWS services and resources.

Learning Objectives

We are going to take a look at four common techniques for gaining initial access to AWS. Two of those techniques we'll discuss theoretically, and two of those techniques we will perform hands-on. The scenarios we will cover include:

• Scenario One: Leaked Credentials
• Scenario Two: Phishing for Stacksets
• Scenario Three: SSRF to IMDS Instance Profile Credentials
• Scenario Four: Vulnerable Automation

The learner should have a good grasp of AWS IAM before starting this room. If you need a refresher, please check out the IAM Module before proceeding.