# AWS Pentesting Tools & Configuration

> Covers AWS pentesting environment setup, including tool installation, credential configuration, IAM permissions, and CLI/SDK preparation for cloud security assessments.

- **URL:** https://hackindex.io/platforms/aws/setup/aws-pentesting-tools-and-configuration
- **Path:** AWS > Setup
- **Up:** [Setup](https://hackindex.io/platforms/aws/setup.md)
- **Published:** 2026-05-24
- **Updated:** 2026-05-24

Set up your attacker machine before starting any AWS engagement. These tools cover credential management, automated auditing, manual exploitation, and scripting.

Tools covered on this page:

- AWS CLI for direct API interaction and credential management
- Pacu for automated exploitation and privilege escalation
- ScoutSuite and Prowler for configuration auditing
- enumerate-iam for brute-forcing allowed IAM actions
- aws_consoler for converting credentials to console access

## AWS CLI

Primary interface for interacting with AWS APIs. Most attack tools rely on it for credential resolution.

```bash
pipx install awscli
```

Configure a named profile for each credential set:

```bash
aws configure --profile $PROFILE
```

Stores credentials in `~/.aws/credentials` and config in `~/.aws/config`. Use `--profile $PROFILE` on every command or export `AWS_PROFILE=$PROFILE` in your shell.

Verify access and identify the current principal:

```bash
aws sts get-caller-identity --profile $PROFILE
# {
#     "UserId": "AIDA...",
#     "Account": "123456789012",
#     "Arn": "arn:aws:iam::123456789012:user/jdoe"
# }
```

Confirm which identity you are operating as before continuing.

## Pacu

AWS exploitation framework. Covers IAM enumeration, privilege escalation, persistence, and lateral movement modules.

```bash
pipx install pacu
```

Launch and create a session:

```bash
pacu
```

Import credentials from an existing AWS CLI profile:

```bash
import_keys $PROFILE
```

List available modules:

```bash
ls
```

Pacu stores session data locally. Use a separate named session per engagement.

## ScoutSuite

Multi-cloud security auditing tool. Produces an HTML report of misconfigurations across IAM, EC2, S3, RDS, Lambda, and more.

```bash
pipx install scoutsuite
```

Run against an AWS account:

```bash
scout aws --profile $PROFILE
```

Report lands in `scoutsuite-report/`. Use it as a map for manual follow-up: not as a final deliverable. Findings are categorized by severity and service.

## Prowler

Security assessment tool with CLI-focused output. Maps findings to CIS, NIST, and other frameworks.

```bash
pipx install prowler
```

Full assessment:

```bash
prowler aws --profile $PROFILE
```

Scope to specific services:

```bash
prowler aws --profile $PROFILE -s iam s3 ec2
```

Use `-M csv` or `-M json` for machine-readable output. Useful for rapid gap analysis on large accounts before manual work.

## enumerate-iam

Brute-forces allowed IAM actions for a credential set: identifies what actions are permitted without needing direct policy access.

```bash
git clone https://github.com/andresriancho/enumerate-iam
cd enumerate-iam
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
```

```bash
python3 enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY --session-token $AWS_SESSION_TOKEN
```

> [!WARNING]
> This tool generates significant API noise: every allowed action fires a real request. Expect CloudTrail entries for every tested call.

## aws_consoler

Converts temporary AWS credentials into a signed console URL. Useful for confirming access level or demonstrating impact.

```bash
pipx install aws-consoler
```

Generate a console URL from a named profile:

```bash
aws_consoler -p $PROFILE
```

Output is a browser-ready URL valid for a short session. Does not work with long-term IAM user keys: requires session credentials.

## boto3

Python SDK for custom enumeration scripts and automation beyond what CLI tooling covers.

```bash
python3 -m venv .venv && source .venv/bin/activate
pip install boto3
```

Always use an explicit session with a named profile to avoid ambient credential bleed between engagements:

```python
import boto3

session = boto3.Session(profile_name="$PROFILE")
iam = session.client("iam")
response = iam.list_users()
```