I just completed Tyler Ramsbey's Intro to AWS pentesting course, approaching it from a GRC professional's perspective. The results were sobering: An environment passing 82% of Cloud Security Posture Management checks was completely compromised in under 30 minutes. 

Switching to this side of the keyboard in simulated attack scenarios helps GRC practitioners to: 

• Ask better risk assessment questions 

• Speak the same language as more technical teams 

• Prioritize remediation based on actual exploit paths 

If you'd like to join me in sharpening your technical acumen to narrow the gap between GRC and offensive security, try the "AWS Beanstalk Secrets" scenario here, check out my walkthrough below, and of course consider Tyler's awesome course. As he would say, "Happy Hacking!" 

Table of Contents

• Prerequisites

  • AWS Account

  • VirtualBox with Kali

  • Notion

  • Flameshot

  • Pacu AWS Exploitation Framework

  • CloudGoat

  • Create the “beanstalk_secrets” Scenario

• Attack Scenario Overview

  • The Vulnerable Environment

  • What is Elastic Beanstalk?

  • Example Use Case

  • Attack Chain Summary

• Enabling AWS Services Before the Attack

  • AWS Security Hub CSPM

  • GuardDuty Threat Detection

  • VPC Flow Logs

  • CloudTrail Insights

• Privilege Escalation Walkthrough, Mapped to MITR …

  • NIST SP 800-53 Security Posture Score: 82%

• Initial Access

  • Phase 1: Credential Compromise & Initial Authentic …

    • Commands Executed:

    • ⚔️ MITRE ATT&CK Technique:

    • 🔴 NIST SP 800-53 Control Failures Exploited:

      • IAM.6 - CRITICAL: Hardware MFA Not Enabled for Roo …

      • IAM.19 - MEDIUM: MFA Not Enabled for IAM Users (4 …

• Discovery

  • Phase 2: Enumerate Beanstalk Applications & Extrac …

    • Commands Executed:

    • ⚔️ MITRE ATT&CK Techniques:

    • 🔴 NIST SP 800-53 Control Failures Exploited:

      • Config.1 - CRITICAL: AWS Config Not Enabled

      • ElasticBeanstalk.2 - HIGH: Managed Platform Update …

      • S3.17 - MEDIUM: S3 Buckets Not Encrypted with KMS …

• Lateral Movement

  • Phase 3: Configure Secondary Credentials & Verify …

    • Commands Executed:

    • ⚔️ MITRE ATT&CK Technique:

    • 🔴 NIST SP 800-53 Control Failures Exploited:

      • SecretsManager.1 - MEDIUM: Secrets Without Automat …

      • CloudTrail.5 - LOW: CloudTrail Not Integrated with …

• Privilege Escalation

  • Phase 4: Identify & Exploit CreateAccessKey Permis …

    • Commands Executed:

    • ⚔️ MITRE ATT&CK Techniques:

    • 🔴 NIST SP 800-53 Control Failures Exploited:

      • IAM.7 - MEDIUM: Weak Password Policy Configuration

      • Account.2 - HIGH: Not Part of AWS Organizations

• Persistence

  • Phase 5: Configure Admin Access & Verify Privilege …

    • Commands Executed:

    • ⚔️ MITRE ATT&CK Technique:

    • 🔴 NIST SP 800-53 Control Failures Exploited:

      • CloudTrail.2 - MEDIUM: CloudTrail Not Encrypted at …

      • CloudTrail.4 - LOW: Log File Validation Not Enable …

      • Macie.1 - MEDIUM: Amazon Macie Not Enabled

• Collection & Exfiltration

  • Phase 6: Retrieve Secrets from AWS Secrets Manager

    • Commands Executed:

    • ⚔️ MITRE ATT&CK Techniques:

    • 🔴 NIST SP 800-53 Control Failures Exploited:

      • S3.8 - HIGH: S3 Buckets Not Blocking Public Access

      • EC2.9 - HIGH: EC2 Instances with Public IPv4 Addre …

      • EC2.6 - MEDIUM: VPC Flow Logging Not Enabled (2 VP …

• Post-Incident Analysis: Learning from AWS Native S …

  • What AWS Automatically Captured

    • GuardDuty: Threat Intelligence at Work

    • VPC Flow Logs: Network Visibility

    • CloudWatch Logs: Comprehensive API Audit Trail

• The Bottom Line

Prerequisites

AWS Account

• Create a free account

• Set up a $0.1 budget alert

• Also remember to destroy your CloudGoat scenarios after completing the walkthrough to avoid unexpected AWS charges. Run cloudgoat destroy beanstalk_secrets when finished.

VirtualBox with Kali

• Install VirtualBox

• Install Kali

• Install the AWS CLI for Kali

• Install Terraform on Kali

Notion

• I prefer Obsidian as a daily driver for notes but its SaaS offering has a cost, so a free Notion account comes in handy for pen test challenges like this, synching in real time between your laptop and Kali on your Virtual Machine

Flameshot

apt install flameshot

• I learned about this app in the course and it works well

Pacu AWS Exploitation Framework

pipx install git+https://github.com/RhinoSecurityLabs/pacu.git

CloudGoat

pipx install cloudgoat

Create the “beanstalk_secrets” Scenario

Attack Scenario Overview

The Vulnerable Environment

What is Elastic Beanstalk?

AWS Elastic Beanstalk is a Platform-as-a-Service (PaaS) that simplifies deploying and scaling web applications. Despite its widespread use, Elastic Beanstalk is frequently overlooked in security assessments. Security teams often focus on EC2 instances and Lambda functions while missing Beanstalk environments entirely. This oversight is critical because developers frequently store API keys, database credentials, and other sensitive data in Beanstalk environment variables, treating them as a secure configuration store when they're actually accessible to anyone with basic read permissions.

Example Use Case

Attack Chain Summary

Enabling AWS Services Before the Attack

To help our understanding of the vulnerabilities in this cloud environment before, during and after the attack, let’s enable some helpful native AWS services.

AWS Security Hub CSPM

Security Hub CSPM (Cloud Security Posture Management) provides centralized security findings and compliance monitoring.

It takes about 15 minutes to complete the first scan, which runs daily. Before the attack even begins we see a security score of only 77% and 120 findings raised in this intentionally vulnerable (for practicing pen test techniques) environment.

GuardDuty Threat Detection

GuardDuty uses machine learning to identify malicious activity and unauthorized behavior.