AWS for Red Teamers

AWS environments are built on layers of identity, trust, and policy logic that are difficult to reason about in isolation. That complexity is exactly what attackers exploit. AWS for Red Teamers gives red teamers, penetration testers, cloud security engineers, and defenders a practical understanding of privilege escalation and lateral movement in AWS. The course focuses on identity-based attack paths and shows how permissions boundaries, trust policies, and IAM Conditions can either constrain an attacker or create an opening.

Through 25 hands-on labs, students work in intentionally vulnerable environments covering IAM, EC2, SSM, Lambda, EKS, CloudFormation, S3, and KMS. Each lab deploys into a dedicated AWS sandbox account and provides an entry identity with a path to a target role or flag. Students enumerate what that identity can do, identify the escalation primitive, and test the path. The course builds from individual techniques to a capstone that chains them across account boundaries.

By the end of the course, students will be able to assess AWS identity and policy relationships, validate potential attack paths, and combine escalation techniques into a cohesive cross-account chain. They will also have a stronger mental model of AWS trust that they can apply to both offensive assessments and defensive security work.

Learning objectives

By the end of this course, students will be able to:

• Explain how AWS policy logic works, including permissions boundaries, trust policies, and IAM Conditions.
• Enumerate an AWS identity’s permissions and map the roles and resources it can reach.
• Recognize and test escalation paths involving role trust, policy manipulation, access keys, and federated identities.
• Assess escalation opportunities across IAM, EC2, SSM, Lambda, EKS, CloudFormation, S3, and KMS.
• Inspect the AWS identity graph, validate attack paths, and identify opportunities that cross account boundaries.
• Chain individual escalation techniques into a cross-account attack path in the capstone.

Student requirements

• Hardware — A machine capable of running the AWS CLI, Terraform, and Go. No local virtual machine is required.
• Knowledge — Basic familiarity with AWS and the command line. Prior cloud red teaming or privilege-escalation experience is not required.
• Cloud environment — At least one dedicated AWS sandbox account with an administrative identity. Separate staging and prod accounts are optional for the service labs but required for the cross-account capstone. Do not use accounts containing production workloads, customer data, or shared credentials.
• Tooling — AWS CLI, Terraform 1.6 or later, Git, Go, and make to build the lab tooling; jq and zip for walkthroughs; and kubectl for the EKS labs and capstone.

Who this course is for

This course is for red teamers, penetration testers, cloud security engineers, and defenders who want to understand AWS privilege escalation from an attacker’s perspective. It is designed to build practical offensive skills while helping defenders recognize and harden the trust relationships those attacks depend on.

About the course author

Julian Catrambone (@n0pe_sled) is a Senior Offensive Security Engineer at SpecterOps. He has over a decade of IT experience as an offensive security engineer performing tasks such as penetration testing, web application assessments, social engineering, red team assessments, and purple team assessments. He has spoken at BSides Seattle and SO-CON about various attacks against the Linux-based directory service FreeIPA and AWS. Julian has recently specialized in attacking cloud-based platforms such as AWS and Azure. Tools and open-source projects developed by Julian can be found on his GitHub page at github.com/n0pe-sled.