What we test
Cloud Infrastructure Penetration Testing
Testing the cloud account itself: what an attacker reaches after one credential leaks, and how far identity and network configuration let them go.
Who asks for this
Companies whose auditor asked about infrastructure rather than application controls, and companies that have grown a cloud account faster than they have reviewed it.
What the test covers
- Identity and access management: role trust policies, privilege escalation paths, unused long-lived keys
- Publicly reachable resources that were not meant to be, including storage and management interfaces
- Network segmentation between environments and between workloads
- Secrets in instance metadata, environment variables, build systems and images
- Logging and detection coverage, tested by generating the activity that should trigger it
- Container and orchestration configuration where workloads run on Kubernetes or similar
What this test typically finds
Classes of finding, not a severity table. These are the issues that recur on this surface.
Privilege escalation through role chaining
A low-privilege identity that can assume a role, that can pass a role, that ends at administrator. Each step looks reasonable alone.
Long-lived credentials with wide reach
Access keys years old, attached to a broad policy, present in a CI system that more people can read than anyone realizes.
Environments that are not actually separated
A staging workload that can reach a production database because the network boundary exists on a diagram and not in a security group.
Detection that does not fire
Logging configured and alerting absent, so the activity is recorded and nobody is told. Worth finding before an auditor asks how you would know.
Questions people ask
Do you need permission from AWS or Azure to run a penetration test?
Major cloud providers permit customer penetration testing of your own resources within a published policy, without prior approval for common service categories. Some activities, notably anything resembling denial of service, remain prohibited or require prior arrangement. The applicable policy is confirmed in the rules of engagement before testing starts.
Is a cloud configuration review the same as a penetration test?
No. A configuration review compares settings against a benchmark. A penetration test starts from a position an attacker could reach, usually one leaked credential, and establishes where they can actually get to. Both are useful; only the second one answers what the blast radius is.
Related surfaces
Get a scoped price without a discovery call
Tell us what is in scope and what your audit needs. You get a fixed price and a date, not a quote after two meetings.