Enumerating Cloud Resources

Enumeration turns a single credential or anonymous foothold into a map of the environment. You want to know what identity you hold, what it can do, and what resources exist.

• Identify the principal (who am I?).
• Inventory resources (what exists?).
• Discover permissions and trust paths (what can I reach?).

Always start by confirming the active principal. This tells you the account, the identity type, and where to look next.

Before holding any credential, external enumeration finds exposed assets.

• Brute-force predictable bucket and storage names.
• Enumerate public endpoints via certificate transparency and DNS.
• Check for public snapshots, AMIs, and container registries.

Knowing exactly what your principal can do shapes the whole engagement. Some providers let you read your own policies; otherwise you brute-force permissions by attempting harmless calls.

Provider CLIs and aggregated views enumerate resources fast.

• AWS Resource Groups Tagging API or describe-* calls.
• Azure Resource Graph queries across subscriptions.
• GCP asset inventory.

Dedicated tools accelerate misconfiguration discovery across an account.

• ScoutSuite produces a multi-service HTML risk report.
• Prowler runs hundreds of CIS-benchmark checks.
• CloudMapper / Cartography graph relationships.

The most valuable enumeration output is the IAM graph: who can assume which role, and which policies grant escalation. Graph tools reveal paths a flat policy review misses.

Once you can list storage, enumerate contents for secrets and PII.

• List buckets/containers, then objects.
• Look for backups, .env files, terraform state, and DB dumps.
• Terraform state often contains plaintext secrets.

Map the network and running workloads to find pivot points.

• Security groups / NSGs reveal exposed ports.
• Running instances and their roles are lateral-movement targets.
• Managed databases and their access rules indicate data stores.

Enumeration generates control-plane log entries. To reduce noise and stay ethical:

• Prefer read-only describe/list/get calls.
• Throttle requests to avoid rate-limit alerts.
• Avoid destructive or billable actions during recon.
• Record every call so blue team can correlate later.

Good enumeration produces a prioritized target list: over-permissioned roles, public storage, exposed services, and assumable cross-account roles. This feeds the exploitation phase.

Document findings with the exact API calls used so they are reproducible and auditable.

Confirm your enumeration fundamentals.

You learned to enumerate a cloud environment systematically.

• Identify your principal first, then inventory and permissions.
• Unauthenticated discovery finds public buckets and endpoints.
• ScoutSuite, Prowler, and PMapper automate auditing and IAM graphing.
• Prefer read-only calls and log every action.

Next: exploiting IAM misconfigurations for privilege escalation.