# AWS Asset Exposure Mapping

> Identify and enumerate publicly exposed AWS assets including S3 buckets, EC2 instances, APIs, and misconfigured IAM policies to map an organisation's attack surface.

- **URL:** https://hackindex.io/platforms/aws/reconnaissance/aws-asset-exposure-mapping
- **Path:** AWS > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/aws/reconnaissance.md)
- **Published:** 2026-05-24
- **Updated:** 2026-05-24

Identify what the target exposes to the internet before scanning. AWS infrastructure has recognizable fingerprints: cloud metadata headers, EC2 instance metadata endpoints, and predictable DNS patterns.

Common AWS asset exposure points to map:

- EC2 instances with public IPs or open security groups
- S3 buckets with public access or misconfigured policies
- CloudFront distributions with accessible origin servers
- Public AMIs leaking credentials or internal tooling
- API Gateway endpoints exposed without authentication

## Shodan

Search for EC2 instances and services by organization or IP range. AWS IP ranges are published and Shodan indexes them continuously.

Search by organization:

```
org:"Amazon" hostname:"$DOMAIN"
org:"Amazon" html:"$COMPANY"
```

Search for specific services on AWS IP space:

```
org:"Amazon" port:8080 http.title:"$COMPANY"
org:"Amazon" port:443 ssl.cert.subject.cn:"$DOMAIN"
```

Search for exposed management interfaces:

```
org:"Amazon" port:8443 title:"admin"
org:"Amazon" port:9200 product:"Elasticsearch"
org:"Amazon" port:6379 product:"Redis"
```

The Shodan CLI:

```bash
pipx install shodan
shodan init $SHODAN_API_KEY
shodan search 'org:"Amazon" hostname:"$DOMAIN"' --fields ip_str,port,hostnames,org
```

## CloudFront Origin Discovery

CloudFront distributions sit in front of origins: EC2 instances, S3 buckets, ALBs, or custom servers. The origin IP is often reachable directly if security groups allow it, bypassing WAF and CloudFront restrictions.

Discover the origin IP via:

**SSL certificate history (Censys):**

```bash
pip install censys
censys search "parsed.names: $DOMAIN" --index-type certificates | jq '.[] | .parsed.subject_dn'
```

**Direct IP probe bypassing CloudFront:**

```bash
curl -sk -H "Host: $DOMAIN" https://$TARGET_IP/ -o /dev/null -w "%{http_code}"
```

A `200` response on the direct IP confirms the origin is accessible without CloudFront.

## Public AMI Enumeration

AMIs marked public by mistake or for distribution often contain sensitive data: credentials in user data, hardcoded keys in scripts, or internal tooling.

Search for public AMIs owned by the target account (if you have their account ID from recon):

```bash
aws ec2 describe-images --owners $ACCOUNT_ID --no-sign-request --region us-east-1
```

```bash
aws ec2 describe-images --filters "Name=name,Values=*$COMPANY*" "Name=is-public,Values=true" --no-sign-request --region us-east-1
```

For each found AMI, the description, name, and tags often reveal environment names, application versions, and internal naming conventions.

## AWS IP Range Lookup

AWS publishes all IP ranges at `https://ip-ranges.amazonaws.com/ip-ranges.json`. Cross-reference discovered IPs to confirm what is running on AWS and in which region.

```bash
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | python3 -c "
import json, sys, ipaddress
data = json.load(sys.stdin)
target = '$TARGET_IP'
for p in data['prefixes']:
    try:
        if ipaddress.ip_address(target) in ipaddress.ip_network(p['ip_prefix']):
            print(p)
    except:
        pass
"
```

Knowing the region narrows your scan scope and informs which regional API endpoints to target.

## HTTP Response Fingerprinting

AWS services return identifiable headers. Passive scanning of known domains can confirm AWS-hosted infrastructure:

```bash
curl -sI https://$DOMAIN | grep -i "x-amz\|cloudfront\|AmazonS3"
# x-amz-request-id: ABC123
# x-amz-cf-id: XYZ789
# x-cache: Hit from cloudfront
```

These headers confirm AWS hosting without any active scanning and identify whether CloudFront is in the path.