Pentest Documentation

Appearance

💰 IAM ​

📚 What is IAM ? ​

AWS Identity and Access Management (IAM) is a service that helps you securely control access to AWS resources. IAM enables you to manage users, groups, and roles, and define their permissions to access specific AWS services and resources. It provides the foundation for managing access control in AWS, ensuring that the right users have the appropriate access to the resources they need.

#️⃣ Root User ​

The root user is created when you first set up your AWS account. This user has full administrative privileges and unrestricted access to all resources in the AWS account. It is recommended to use the root user only for tasks that require root-level access and to create IAM users for daily administrative tasks.

👥 IAM Users ​

IAM users are created and managed within your AWS account. Each user has a unique set of security credentials and permissions defined by IAM policies. IAM users are used to interact with AWS services through the AWS Management Console, AWS CLI, or AWS SDKs.

⏰ Long-Term Credentials ​

Long-term credentials consist of an access key ID and a secret access key, which are associated with an IAM user. These credentials do not expire and are used for programmatic access to AWS services. It is important to rotate these credentials regularly to enhance security.

⌚ Short-Term Credentials ​

Short-term credentials are temporary and are generated using AWS Security Token Service (STS). These credentials include an access key ID, a secret access key, and a session token. They are used to grant temporary access to AWS resources and expire after a specified duration. Short-term credentials are often used for roles and federated users.

🧔 Federated users ​

Federated users are users who are authenticated outside of AWS but are granted temporary access to AWS resources. Instead of creating IAM users for each external user, AWS supports federated access, which allows users from external identity providers (such as corporate directories or social identity providers) to access AWS resources using temporary credentials. This approach is more scalable and secure, as it eliminates the need to manage individual IAM users for external entities and leverages existing authentication systems.

🏦 Stored Credentials ​

Stored credentials refer to the practice of saving AWS access keys and secrets in specific locations on your filesystem so that AWS CLI and SDKs can easily retrieve and use them. Properly managing these stored credentials is crucial for maintaining the security and integrity of your AWS environment.

How AWS Stores Credentials ? ​

When using AWS CLI or SDKs, credentials are typically stored in two main files :

  1. Configuration File (config): This file contains configuration settings such as default region and output format.
  2. Credentials File (credentials): This file holds the actual access keys and secret access keys used to authenticate and authorize AWS CLI commands and API requests.

Location of Stored Credentials ​

The location of these files varies depending on the operating system :

  • Windows: The credentials and configuration files are typically located at :
powershell
C:\Users\<username>\.aws
  • Linux/Mac: On Unix-like systems, these files are typically found at :
bash
/home/<username>/.aws

🖵 AWS-CLI ​

The AWS-CLI is a tool that allows you to interact with AWS services from the command line. You can configure the AWS CLI with profiles to manage multiple sets of credentials.

bash
aws config --profile auditor

Configuring and Validating Temporary Credentials ​

To configure the AWS CLI with temporary credentials for a specific profile, use the following commands :

bash
aws configure set aws_access_key_id [key-id] --profile ec2
aws configure set aws_secret_access_key [key-id] --profile ec2
aws configure set aws_session_token [token] --profile ec2

🔎 Enumeration ​

Users ​

  • List of IAM Users
bash
aws iam list-users
  • List the IAM Groups That a User Belongs To
bash
aws iam list-groups-for-user --user-name [user-name]
  • List All Managed Policies Attached to a User
bash
aws iam list-attached-user-policies --user-name [user-name]
  • List the Names of Inline Policies Embedded in a User
bash
aws iam list-user-policies --user-name [user-name]

Groups ​

  • List of IAM Groups
bash
aws iam list-groups
  • List All Users in a Group
bash
aws iam get-group --group-name [group-name]
  • List All Managed Policies Attached to a Group
bash
aws iam list-attached-group-policies --group-name [group-name]
  • List the Names of Inline Policies Embedded in a Group
bash
aws iam list-group-policies --group-name [group-name]

Roles ​

  • List of IAM Roles
bash
aws iam list-roles
  • List All Managed Policies Attached to a Role
bash
aws iam list-attached-role-policies --role-name [role-name]
  • List the Names of Inline Policies Embedded in a Role
bash
aws iam list-role-policies --role-name [role-name]

Policies ​

  • List of All IAM Policies
bash
aws iam list-policies
  • Retrieve Information About a Specific Managed Policy
bash
aws iam get-policy --policy-arn [policy-arn]
  • List Information About Versions of a Managed Policy
bash
aws iam list-policy-versions --policy-arn [policy-arn]
  • Retrieve Information About a Specific Version of a Managed Policy
bash
aws iam get-policy-version --policy-arn [policy-arn] --version-id [version-id]
  • Retrieve the Inline Policy Document Embedded in a User, Group, or Role
bash
aws iam get-user-policy --user-name [user-name] --policy-name [policy-name]
aws iam get-group-policy --group-name [group-name] --policy-name [policy-name]
aws iam get-role-policy --role-name [role-name] --policy-name [policy-name]