E-AWS
AWS
Web console for manually inspecting AWS IAM, S3, EC2, and other services in scope.
OVERVIEW
The AWS Management Console (aws.amazon.com/console) is the official web UI for every AWS service, and during a cloud security assessment it's the natural complement to CLI-driven enumeration: the console makes it fast to click through an IAM user's attached and inline policies, review an S3 bucket's ACL and bucket policy side by side, or check a security group's inbound rules without composing a query.
Distinguish it from the separate AWS CLI entry on this site: this is the browser-based console used with credentials the client hands over (a read-only or assessment-scoped IAM role) for manual, visual verification of findings, while the CLI is what actually drives bulk enumeration and scripting against the account.
USE CASES
Practical use cases
- 01
Manually reviewing an IAM user, role, or policy's effective permissions in the visual policy editor.
- 02
Cross-checking an S3 bucket's ACL, bucket policy, and public-access-block settings before reporting exposure.
- 03
Walking through CloudTrail event history in the console to confirm what an action actually logged.
- 04
Screenshotting misconfigurations directly from the console for the final report.
QUICK START
For manual, click-through review of AWS resource configuration — IAM policies, S3 bucket ACLs, security groups — alongside CLI-driven enumeration with aws-cli.
- Get the client to provision a scoped, read-only (or assessment-specific) IAM role or user for console access.
- Sign in to the console and start with IAM: review users, roles, groups, and policies for over-permissive grants.
- Move to S3, EC2, and other in-scope services, cross-referencing findings already surfaced by aws-cli or Pacu.
- Check CloudTrail to confirm logging coverage and note any regions or services with logging disabled.
BEFORE YOU RUN IT
What to check before running it
Every console action is logged in CloudTrail under the assessor's IAM identity — agree with the client up front on what activity they should expect to see.
Console access alone is slow for bulk enumeration across many resources or regions; use it to verify and screenshot, not as the primary enumeration method.
Never use personal or production credentials for console access — always work from a client-provisioned, scoped identity with an expiry.