Enumeration

AWS enumeration maps the account's attack surface: IAM users, roles, policies, S3 buckets, running services, and resource configurations. Starting from any set of credentials, the goal is to understand what you can reach and what permissions you hold.

IAM enumeration lists users, roles, groups, and attached policies. S3 bucket enumeration checks for listable or readable objects. Service discovery across regions identifies EC2 instances, Lambda functions, RDS databases, and other resources that expand your options.

Tools like enumerate-iam, Pacu, and the AWS CLI with dry-run flags help map permissions without triggering destructive actions.