E-AWS
AWS CLI
Official command-line interface for scripting and enumerating AWS resources — IAM, S3, EC2, and more.
OVERVIEW
The AWS CLI (github.com/aws/aws-cli) is the official command-line tool for every AWS API, and it's what actually drives most AWS-side enumeration during a cloud assessment: `aws iam list-users`, `aws s3api get-bucket-acl`, `aws ec2 describe-instances`, and hundreds of similar calls turn into scripts that walk an entire account far faster than the console.
It pairs naturally with the AWS Management Console entry on this site — the CLI does the bulk enumeration and JSON output that scripts and tools like Pacu build on, while the console is used afterward to visually confirm and screenshot a specific finding.
USE CASES
Practical use cases
- 01
Enumerating IAM users, roles, groups, and attached/inline policies to map effective permissions.
- 02
Listing and inspecting S3 buckets for public access, missing encryption, or permissive bucket policies.
- 03
Scripting an account-wide inventory of EC2 instances, security groups, and VPC configuration.
- 04
Feeding structured JSON output into other tooling (Pacu, custom scripts) for further analysis.
QUICK START
For scripted, repeatable enumeration of an AWS account's IAM, storage, and compute configuration once credentials are in hand.
- Install the AWS CLI and confirm the client-provided access key/role has only the agreed scope.
- Configure a named profile (`aws configure --profile pentest`) rather than overwriting default credentials.
- Run `aws sts get-caller-identity` to confirm which identity and account you're actually enumerating.
- Start broad — `aws iam list-users`, `aws s3api list-buckets`, `aws ec2 describe-instances` — then narrow into flagged resources.
aws sts get-caller-identity --profile pentestBEFORE YOU RUN IT
What to check before running it
Every API call is recorded in CloudTrail under the credentials used — agree with the client on what activity they should expect and for how long the credentials stay valid.
Some list/describe calls are cheap but a few (e.g. Cost Explorer, some Config calls) can incur charges at scale — check pricing before scripting a large loop.
Never hardcode long-lived access keys in scripts or commit history; prefer short-lived credentials via a role assumption where the client supports it.