Cloud platform policies, benchmark checks, and services enumeration
Pentesting cloud networks on public cloud platforms is fundamentally different from pentesting on your organization’s own premises and its own infrastructure.
If your organization owns the premises and infrastructure, it has the legal right to determine everything you’re allowed and forbidden to do to its network for your pentest. If I buy a house, as long as the laws in my municipality and country don’t forbid it, I could allow building contractors to replace walls, redo my roof, install new doors, and so on.
If I rent my house from a landlord, I don’t own my house. I would need my landlord’s permission if I wanted to pay building contractors to make those sorts of modifications to my house.
On Amazon Web Services (AWS), Azure, and Google Cloud Platform (GCP), your organization is “renting its house” from its “landlord”—Amazon, Microsoft...
