An important aspect of pentesting AWS environments is the process of enumerating what permissions your user has, and then escalating those privileges, if possible. Knowing what you have access to is the first battle, and it will allow you to formulate an attack plan in the environment. Next is privilege escalation, where if you can gain further access to the environment, you can perform more devastating attacks. In this chapter, we will dive into the Python boto3 library to learn how to make AWS API calls programmatically, learn how to use it to automate the enumeration of our permissions, and then finally, learn how to use it to escalate our permissions if our user is vulnerable to escalation.
The enumeration of our permissions is very important for a multitude of reasons. One of these is that we will avoid...