# Enumeration > Guides covering AWS service enum across IAM, EC2, S3, and more - **URL:** https://hackindex.io/platforms/aws/enumeration - **Platform:** [AWS](https://hackindex.io/platforms/aws.md) - **Published:** 2026-05-24 - **Updated:** 2026-07-13 AWS enumeration maps the account's attack surface: IAM users, roles, policies, S3 buckets, running services, and resource configurations. Starting from any set of credentials, the goal is to understand what you can reach and what permissions you hold. IAM enumeration lists users, roles, groups, and attached policies. S3 bucket enumeration checks for listable or readable objects. Service discovery across regions identifies EC2 instances, Lambda functions, RDS databases, and other resources that expand your options. Tools like enumerate-iam, Pacu, and the AWS CLI with dry-run flags help map permissions without triggering destructive actions. ## Guides - [CloudFormation](https://hackindex.io/platforms/aws/enumeration/cloudformation.md) - [CloudFormation Stack Enumeration](https://hackindex.io/platforms/aws/enumeration/cloudformation/cloudformation-stack-enumeration.md): Enumerate AWS CloudFormation stacks, resources, outputs, and parameters to map infrastructure, expose sensitive configs, and identify attack paths. - [Cognito](https://hackindex.io/platforms/aws/enumeration/cognito.md) - [Cognito User Pool and Identity Pool Enumeration](https://hackindex.io/platforms/aws/enumeration/cognito/cognito-user-pool-enumeration.md): Techniques for enumerating AWS Cognito User Pools and Identity Pools, uncovering misconfigured auth flows, exposed pool IDs, and unauthenticated access risks. - [EC2](https://hackindex.io/platforms/aws/enumeration/ec2.md) - [EC2 Instance and Security Group Enumeration](https://hackindex.io/platforms/aws/enumeration/ec2/ec2-instance-and-security-group-enumeration.md): Enumerate AWS EC2 instances and security groups using CLI and SDK techniques to map attack surface, expose misconfigurations, and identify lateral movement opportunities. - [EC2 Instance Metadata Service (IMDS)](https://hackindex.io/platforms/aws/enumeration/ec2/ec2-instance-metadata-service.md): Covers IMDSv1/v2 enumeration techniques on EC2 instances, extracting credentials, IAM roles, and instance details via metadata endpoint exploitation. - [ECR](https://hackindex.io/platforms/aws/enumeration/ecr.md) - [ECR Container Registry Enumeration](https://hackindex.io/platforms/aws/enumeration/ecr/ecr-container-registry-enumeration.md): Techniques for enumerating AWS ECR repositories, images, and metadata to identify exposed containers, misconfigurations, and sensitive data in registries. - [EKS / ECS](https://hackindex.io/platforms/aws/enumeration/eks-ecs.md) - [EKS and ECS Cluster Enumeration](https://hackindex.io/platforms/aws/enumeration/eks-ecs/eks-ecs-cluster-enumeration.md): Techniques for enumerating AWS EKS and ECS clusters, tasks, services, and container metadata to map containerised workloads and identify attack surface. - [IAM](https://hackindex.io/platforms/aws/enumeration/iam.md) - [IAM Authenticated Enumeration](https://hackindex.io/platforms/aws/enumeration/iam/iam-authenticated-enumeration.md): Techniques for enumerating AWS IAM users, roles, groups, and policies using authenticated credentials to map permissions and identify privilege escalation paths. - [IAM Unauthenticated Enumeration](https://hackindex.io/platforms/aws/enumeration/iam/iam-unauthenticated-enumeration.md): Techniques for enumerating AWS IAM resources without valid credentials, identifying exposed roles, policies, and principals through unauthenticated API calls. - [Lambda](https://hackindex.io/platforms/aws/enumeration/lambda.md) - [Lambda Function Enumeration](https://hackindex.io/platforms/aws/enumeration/lambda/lambda-function-enumeration.md): Techniques for enumerating AWS Lambda functions, extracting configurations, environment variables, permissions, and identifying misconfigurations for potential exploitation. - [RDS](https://hackindex.io/platforms/aws/enumeration/rds.md) - [RDS Database Enumeration](https://hackindex.io/platforms/aws/enumeration/rds/rds-database-enumeration.md): Techniques for enumerating AWS RDS instances, snapshots, subnet groups, and security configurations to identify exposed databases and misconfigurations. - [Route53 / CloudFront](https://hackindex.io/platforms/aws/enumeration/route53-cloudfront.md) - [Route53 and CloudFront Enumeration](https://hackindex.io/platforms/aws/enumeration/route53-cloudfront/route53-and-cloudfront-enumeration.md): Enumerate AWS Route53 hosted zones, DNS records, and CloudFront distributions to map attack surface, identify misconfigurations, and uncover exposed infrastructure. - [S3](https://hackindex.io/platforms/aws/enumeration/s3.md): Techniques for enumerating AWS S3 buckets, identifying misconfigurations, exposed objects, bucket policies, ACLs, and public access settings during cloud assessments. - [S3 Bucket Enumeration and ACL Review](https://hackindex.io/platforms/aws/enumeration/s3/s3-bucket-enumeration-and-acl-review.md): Enumerate exposed S3 buckets, assess bucket and object ACLs, identify misconfigurations like public read/write access, and map data exposure risks. - [Secrets](https://hackindex.io/platforms/aws/enumeration/secrets.md) - [Secrets Manager and SSM Parameter Store Enumeration](https://hackindex.io/platforms/aws/enumeration/secrets/secrets-manager-and-ssm-parameter-store-enumeration.md): Techniques for enumerating AWS Secrets Manager and SSM Parameter Store to discover stored credentials, API keys, and sensitive configuration data during cloud assessments. - [SQS / SNS](https://hackindex.io/platforms/aws/enumeration/sqs-sns.md) - [SQS and SNS Enumeration](https://hackindex.io/platforms/aws/enumeration/sqs-sns/sqs-and-sns-enumeration.md): Enumerate AWS SQS queues and SNS topics, subscriptions, and policies to identify misconfigurations, exposed resources, and potential privilege escalation paths. - [VPC](https://hackindex.io/platforms/aws/enumeration/vpc.md) - [VPC and Network Enumeration](https://hackindex.io/platforms/aws/enumeration/vpc/vpc-and-network-enumeration.md)