Pacu can be used to test an AWS account. Setup:

1. Login via the AWS cli and create/reuse a pro­file:
   aws configure --profile $profile
2. Start pacu
3. Import the access and secret key and oth­er pro­file set­tings from the AWS CLI with
   import_keys $profile

Unauthorized enumeration

Requires only an AWS access key and secret key.

Enu­mer­ate roles. Cre­ate a list with pos­si­ble roles to check.

run iam__enum_roles --word-list /tmp/roles.txt --account-id $accountId

Enu­mer­ate users which belong to a (pre­vi­ous­ly found) role. Cre­ate also a list of pos­si­ble user names.

run iam__enum_users --word-list /tmp/users.txt --role-name $role --account-id $accountId

Enu­mer­ate snap­shots. $key­word is some­thing which is e.g. in a S3 buck­et name.

run ebs__enum_snapshots_unauth --keyword $keyword --account-id $accountId --account-id-wordlist $accountIdWordlist

Various

To see the whole response: Select the area:

services

and then request the data from one area:

data iam

To assume a pre­vi­ous­ly found role, use

assume_role arn:aws:iam::$accountID:role/$roleName