Cloud Pentest AWS, Azure & GCP
A cloud pentest is a penetration test of your cloud environment — AWS, Azure and GCP — that exploits IAM flaws, storage exposure, misconfigurations, CI/CD pipeline secrets and containers/Kubernetes to prove, with evidence, what an attacker could reach starting from your account.
What a cloud pentest is
A cloud pentest assesses the security of an environment hosted on providers such as AWS, Azure and Google Cloud from a real attacker's perspective. Unlike a traditional network pentest, the focus is on the cloud control plane — identities, permissions, policies, keys and how managed services are configured — not just the operating systems and applications running inside it.
Under the shared responsibility model, the provider secures the infrastructure, but the configuration of identities, buckets, networks and pipelines belongs to the customer. That is exactly the layer where most cloud incidents happen. Berghem combines automated enumeration with manual exploitation to turn insecure configurations into concrete attack scenarios, with a reproducible escalation path and impact-prioritized recommendations.
For regulated institutions, cloud scope must also meet sector requirements — including the BACEN/CMN resolutions on cybersecurity and cloud computing. We structure the test to produce evidence useful to your compliance process.
What's included
What we test in a cloud pentest
We cover both the cloud control plane and the data plane. Each domain below is enumerated, manually validated and chained into attack paths that demonstrate real impact — never just an isolated tool finding.
IAM and privilege escalation
We analyze users, roles, groups and policies for excessive permissions, overly permissive policies, misconfigured cross-account trust and escalation paths. We map how a low-privilege credential can reach account administrator by abusing actions such as iam:PassRole, role assumption and poorly designed federation.
Storage exposure
Public buckets and blobs with loose ACLs are a leading cause of cloud leaks. We check S3, Azure Blob Storage and Google Cloud Storage for anonymous access, undue listing, public policies, unprotected versioning and exposed sensitive data, including forgotten snapshots and backups.
Service misconfigurations
Misconfigured managed services open the door for attackers. We review open security groups and firewalls, internet-facing databases, serverless functions with broad permissions, poorly managed KMS keys, disabled logging and instance metadata exposed to SSRF.
Secrets in CI/CD and IaC
Pipelines and repositories often store access keys, tokens and credentials in variables, logs and Infrastructure as Code files. We hunt for leaked secrets, over-privileged runners and pipeline service accounts, and misconfigured OIDC — vectors that jump straight into production cloud.
Containers and Kubernetes
We assess vulnerable images, exposed registries, permissive RBAC, privileged pods, service accounts with mounted tokens and container escape paths. In managed clusters (EKS, AKS, GKE) we check the link between Kubernetes identity and cloud IAM, a common escalation vector.
Network and external surface
We enumerate the external surface exposed by the cloud — endpoints, load balancers, management APIs and published assets — and test segmentation, VPCs, peering and routes. The goal is to identify what is reachable from the internet and how it connects initial access to the rest of the environment.
Coverage by platform
Each provider has its own identity model and managed services. We adapt the methodology to the specifics of each cloud, whether a single environment or multi-cloud.
AWS pentest
AWS penetration testing focused on IAM, STS and role assumption, S3 buckets, Lambda functions, EC2 metadata (IMDS), EKS and KMS keys. We map escalation paths and lateral movement across accounts of an AWS Organization.
Azure pentest
Assessment of Azure and Entra ID (Azure AD): roles and RBAC, service principals and managed identities, Azure Blob Storage, Key Vault, Functions and AKS. We analyze the boundaries between the identity tenant and resource subscriptions.
GCP pentest
Penetration testing in Google Cloud focused on IAM and service accounts, impersonation and token generation, Cloud Storage, Cloud Functions, GKE and Secret Manager. We check permission inheritance across the organization, folder and project hierarchy.
How we run the test
We work with agreed rules of engagement and a secure channel with the client from start to finish. The test can start from an external perspective (no credentials) or assume a low-privilege identity to measure the blast radius of a compromised credential.
Scope and rules of engagement
We define in-scope accounts, subscriptions and projects, the testing model (external or assumed credential), windows and limits. We align authorization with the provider where applicable and agree on the exercise objectives.
Enumeration and mapping
We inventory identities, permissions, services and exposed assets using enumeration tooling and manual review. We build the graph of relationships between identities and resources to locate the most promising escalation paths.
Exploitation and escalation
We exploit insecure configurations in a controlled way — privilege escalation, data access, lateral movement across services and accounts — chaining flaws into full attack scenarios while preserving the stability of the environment.
Report and remediation
We deliver each finding with a proof of concept, evidence, severity rating and impact-prioritized remediation. We present the results technically and offer a retest to validate the fixes applied.
Related services
Cloud pentesting usually pairs with other offensive-security and secure-development efforts.
Network Pentest
Internal and external infrastructure penetration testing — complements cloud scope by covering the corporate and hybrid network.
API Pentest
Cloud applications expose APIs. We test authentication, authorization and business logic of your REST and GraphQL interfaces.
DevSecOps
Security integrated into the CI/CD pipeline and Infrastructure as Code — fixes at the source the flaws found in a cloud pentest.
Offensive Security
Overview of Berghem's offensive-security pillar: pentest, Red Team and adversary simulation.
Frequently asked questions about cloud pentesting
What's the difference between a cloud pentest and a traditional network pentest?
Do I need cloud-provider authorization for the test?
Is the test run externally or with cloud credentials?
Does a cloud pentest meet compliance requirements?
Ready to test your cloud?
In a 30-minute conversation we map your AWS, Azure or GCP environment and design the ideal cloud-pentest scope.
Talk to a specialist