Find the rolethat owns your AWS Org.
Manual AWS penetration testing across IAM, EC2, S3, Lambda, ECS, Cognito, KMS, and CloudTrail, exercised by hand for IMDSv2-bypass via SSRF, sts:AssumeRole chain to AdministratorAccess, S3 bucket-policy bypass, Lambda execution-role over-scope, and Cognito user-pool misconfig. Every finding lands with a working proof-of-exploit, code-level fix guidance, and a re-test.
CREST-conducted · CERT-In empanelled · Org-wide vantage
One AWS, full depth
Every service under your IAM Identity Center umbrella, IAM, EC2, S3, Lambda, ECS, KMS, CloudTrail. One method, one Org.
Working proof-of-exploit
Real STS session captures, IAM policy diffs, and SDK traces, not a CSPM scan score.
Re-test included
Every finding re-tested after your team ships the fix. One engagement, closed loop.
The window from vulnerability discovery to exploitation has gone from weeks to hours.
Trusted by security teams across Fintech, SaaS & Education, Enterprise & Telecom, Security & Critical Infrastructure
On record
Why a config audit isn't a pentest
A flag passed is not a path closed.
AWS Config, Security Hub, and Trusted Advisor grade configurations, and an Org with every control green can still hand an attacker AdministratorAccess. SecureLayer7's operators chain the flags an audit calls 'low': IMDSv2 reachable through a public Lambda, an over-permissive instance profile, an unloved sts:AssumeRole trust policy. Then we walk you through the proof your auditor will accept and your team will fix.
IN SCOPE.
Where we look across your AWS Org.
Cross-account assume-role, SCP gaps, OIDC trust, identity-center to org-root paths.
IMDSv1 fallthrough, container escape, function role over-privilege, layer poisoning.
Bucket policies, snapshot sharing, KMS key grants, RDS public-snapshot exposure.
VPC peering, transit gateway, PrivateLink, security-group drift across the org.
AWS BUG FAMILIES WE NAME.
The IAM and service chains an AWS auditor will not catch.
- 01AssumeRole confused deputy
Cross-account sts:AssumeRole with weak ExternalId, principal wildcard in trust policy, lateral pivot to victim account.
- 02PassRole to admin
iam:PassRole on a higher-tier role, attach to a Lambda or EC2 launch, escalate from app role to administrator.
- 03SSRF to IMDS
Server-side fetch into 169.254.169.254, IMDSv1 left enabled, EC2 instance-role credentials stolen from the metadata service.
- 04Lambda role overscope
Function execution role granted * on S3 or DynamoDB, attacker abuses the function trigger to read every bucket in the account.
- 05S3 bucket-policy bypass
Public ACL plus signed-URL replay, or Condition keys that fail open on missing aws:SourceVpce.
- 06KMS grant abuse
CreateGrant on a customer master key from a compromised role, decrypt RDS snapshots and EBS volumes from outside the account.
- 07Cognito identity drift
Identity-pool unauthenticated role grants real AWS credentials, signup-then-pivot from anonymous web client to data plane.
- 08CloudTrail blind spot
Multi-region trail disabled, S3 data-events off, attacker stages exfil through a region where logging never landed.
What we test —
Four AWS surfaces. One Org-wide engagement.
Every AWS pentest is threat-modelled to your Org structure, IAM graph, and account topology — then exercised by hand against named bug classes across identity, compute, data, and posture controls.
Identity & access
IAM role chaining, sts:AssumeRole over-scope, IAM Identity Center / SSO permission-set drift, Cognito user-pool ID-token confusion, instance-profile credential reuse, federated-role trust-policy bypass, IAM Access Analyzer blind spots, root-account fallback paths.
Compute & runtime
EC2 IMDSv2-bypass via SSRF, Lambda execution-role over-scope, EKS service-account abuse, ECS task-role chaining, Fargate trust-policy reuse, EBS snapshot exfil, AMI-based persistence, Systems Manager Session Manager impersonation.
Data & storage
S3 bucket-policy bypass, Object Ownership confusion, KMS key-policy misuse, Secrets Manager rotation drift, RDS IAM-auth gap, DynamoDB stream replay, EBS snapshot public exposure, Glue catalog data leakage.
Posture & detection
CloudTrail trail-tampering, GuardDuty finding suppression, AWS Config rule drift, AWS Organizations SCP gaps, CloudWatch log-group ACL bypass, EventBridge rule reuse, Audit Manager evidence drift, IAM Access Analyzer false-clean.
AWS PENTEST METHODOLOGY.
Eight phases. Org-wide, closed-loop.
Threat-modelled to your Org structure, IAM graph, and account topology. Not a template we run against every cloud.
- 01Scope & threat-model
- 02Recon & enumeration
- 03Configuration review
- 04Identity exploitation
- 05Workload exploitation
- 06Vulnerability analysis
- 07Remediation guidance
- 08Patch verification
Insights
AWS security Resources.
STS assume-role chains, S3 bucket drift, and the IAM mistakes our reviewers keep finding in AWS estates.
Meet our expert
One named lead on every AWS engagement.
John Dill
vCISO at SecureLayer7
15+
Years in offensive security
150+
Engagements led to date
99.99%
On-time engagement delivery
John scopes AWS engagements against your Org structure, IAM Identity Center scope, and account topology. He guides the pod from kick-off through final report and re-test.
- Scopes single-account, multi-account, and IAM Identity Center engagements against your real risk model.
- Owns kick-off, mid-engagement check-ins, and live walkthrough of every finding.
- Drives remediation review and re-test until every Org-wide path is closed.
Ready to scope an AWS pentest? Book 30 minutes with John to walk through your Org structure, IAM graph, and timeline.
Book a 30-min callTested by industry.
The bug classes named below come from real engagements in each sector. Pick the closest fit.
FinTech
Banking workloads on AWS, KMS / Cognito boundaries, treasury access patterns.
HealthTech
HIPAA-scoped AWS workloads, S3 PHI exposure, Lambda EHR integrations.
Built for India engagements
What changes when we deliver here.
Compliance scoping
IAM and AssumeRole chain graph in the report annexure
Regulatory framework
RBI cloud guidance clauses cited per AWS finding
Local engagements
Mumbai region residency reviews for BFSI workloads
Local pricing
INR per-account fixed fee, GST e-invoice
Compliance scoping
MeitY data-localisation trace for S3 and RDS replicas
AWS questions Indian cloud leads ask.
Do you test AssumeRole chains across accounts?
Yes. We graph the trust policies, then attempt privilege escalation through SCP gaps. Each chain step is shown with the IAM JSON.
How is Mumbai region residency verified?
Region locks, KMS multi-region keys, RDS replicas and S3 replication rules are reviewed. The MeitY localisation note ships with the report.
Is testing authorised under AWS rules?
Yes. Tests run within the AWS Customer Support Policy for Penetration Testing. Permission documented in the SOW annexure.
Does this map to RBI cloud guidance?
Yes. Each AWS finding tags the matching April 2023 RBI clause. Shared-responsibility split is shown service by service.
Delivery in India
AWS IAM review. RBI cloud-aligned.
IAM, AssumeRole chains, S3 exposure and KMS reviewed. Findings cite the RBI cloud guidance clause and the AWS region choice for residency.
- Direct line
- +91-20-71600505
- Office
- Pune, Maharashtra, India
Frameworks scoped: CERT-In · DPDP Act · RBI CSF · SEBI CSCRF · ISO/IEC 27001 · PCI DSS.
Sample engagement report
See what arrives in your inbox.
A pre-vetted sample report: full Org-wide kill chain, working PoC traces, IAM policy diffs, and re-test scope. Sent on request after a 5-minute scoping call.