Techzone/AWS - Amazon Web Services

AWS - Amazon Web Services

2 min readArticle

AWS is the dominant cloud provider. As of 2024 it holds ~33% of the cloud market. If you're doing any kind of enterprise security work, cloud assessments, or just building things, you need to know your way around it.

Core Concepts

  • Region - Geographic area (us-east-1, eu-west-1, etc.)
  • AZ (Availability Zone) - Data centers within a region
  • VPC - Virtual Private Cloud — your isolated network
  • IAM - Identity and Access Management — who can do what
  • S3 - Simple Storage Service — object/blob storage
  • EC2 - Elastic Compute Cloud — virtual machines

Most Used Services

Service What It Is
EC2 Virtual machines / compute
S3 Object storage
RDS Managed relational databases
Lambda Serverless functions
VPC Virtual private network
IAM Identity and access control
CloudTrail Audit logging (critical for security)
GuardDuty Threat detection
WAF Web Application Firewall
Route53 DNS

AWS CLI Setup

bash 
# Install
pip install awscli

# Configure credentials
aws configure
# AWS Access Key ID: AKIA...
# AWS Secret Access Key: ...
# Default region: us-east-1
# Output format: json

# List S3 buckets
aws s3 ls

# Check who you are
aws sts get-caller-identity

# List EC2 instances
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name,PublicIpAddress]' --output table

Security-Relevant Things to Know

bash 
# Check IAM policies attached to current user
aws iam list-attached-user-policies --user-name myuser

# List all S3 buckets and check public access
aws s3api list-buckets
aws s3api get-bucket-acl --bucket BUCKETNAME

# Look at CloudTrail for activity logs
aws cloudtrail describe-trails
aws cloudtrail lookup-events --max-results 10

# Check security groups (firewall rules)
aws ec2 describe-security-groups

Common Security Misconfigurations

  • Public S3 buckets (bucket policies that allow * principal)
  • Overly permissive IAM roles (AdministratorAccess attached everywhere)
  • EC2 instances with public IPs and open security groups (0.0.0.0/0)
  • Unused access keys that haven't been rotated
  • CloudTrail disabled or logging to a misconfigured bucket
  • Root account being used instead of IAM users
  • No MFA on IAM accounts

S3 Bucket Enumeration (Security Testing)

bash 
# Check if bucket exists and is public
aws s3 ls s3://company-name-backup --no-sign-request

# Download entire public bucket (careful!)
aws s3 sync s3://target-bucket . --no-sign-request

Pricing Model

Pay-as-you-go. EC2 instances are billed per second (Linux) or per hour (Windows). Easy to rack up bills accidentally — always set billing alerts.

See Also

  • microsoft-azure-guide - Microsoft's cloud platform
  • google-cloud-platform-guide - GCP
  • cloud/index - Cloud overview
techzonesite.comUnlock Your IT Potential