AtlantSECURITY Let’s talk
Menu

Penetration Testing

Cloud Pentest: Penetration Testing That Proves What One Leaked Key Can Reach. Report in 14 Days, Free Retest.

In AWS, Azure and GCP the perimeter is an identity, so we measure the distance that matters: how many role assumptions sit between a leaked access key and your production database.

Our cloud pentest is scoped around the six boundaries that decide what a compromised identity can reach: IAM and privilege escalation, storage and snapshots, metadata and pipeline secrets, Kubernetes and serverless, network paths, and the hybrid trust from on-premises Active Directory. Every finding is a proven path with its business consequence and the API calls that reproduce it. Fixed price, report in 14 days, free retest.

  • Attack paths chained from one identity, with the API calls that prove each step
  • Every finding mapped to a CIS Benchmark recommendation and the control your auditor will cite
  • Written rules of engagement inside AWS, Azure and Google Cloud terms, with a stop condition
Scope My Cloud Pentest View pricing See Client Results
CIS BenchmarksAWS Pentest PolicyAzure RoESOC 2ISO 27001NIST 800-53 CA-8
Cloud pentest: the exterior of a modern data centre building photographed as architecture - Atlant Security

Senior-led testing scoped to the way a cloud estate is built: accounts, the pipeline that deploys into them, the clusters inside, and the directory that signs everyone in.

See a sample pentest report ↗
Cover of the illustrative penetration test report

SEE THE DELIVERABLE

See what a useful
penetration test report looks like.

Review a combined engagement covering web, REST and GraphQL APIs, gRPC, SaaS tenant isolation, Android and iOS, networks, cloud, identity and CI/CD. Includes technical evidence, remediation and retest criteria.

62 pages. 24 findings. 14 charts, diagrams and matrices.
Illustrative penetration test. The organisation, systems and findings are fictional.

Get the sample report

A free PDF. Enter your email and company name, and we’ll email you a download link.

Use a company email address. Free and disposable email services are not accepted.

We’ll email you a download link and an invitation to discuss your security assessment needs. Privacy policy.

DEFINE YOUR SCOPE

Turn your testing requirements into a clear RFP.

Build one request for your applications, APIs, networks, and cloud. Review the scope, download your document, and send a copy to your inbox and our team.

Only questions relevant to your scope. Estimates and “not sure” are welcome.

200+Security Assessments
14Countries
14Days to Report
FreeRetest After Remediation
Alexander Sverdlov, founder of Atlant Security
Alexander SverdlovFounder, Atlant SecurityCISSP, CEH, CHFI, Mandiant

Leads every cloud pentest personally, runs the remediation workshop with your engineers and signs the attestation letter your auditor reads.

Connect on LinkedIn

01 / THE DETAIL

What a Cloud Pentest Actually Tests

A cloud pentest scopes by what an identity can reach, because in AWS, Azure and GCP a policy document decides more than a firewall rule does. Six boundaries cover almost every environment we assess.

Identity and privilege escalation

IAM users, roles, service principals and service accounts: who can pass a role, attach a policy, update a function or assume into another account, chained from the identity you give us to the highest it can reach.

Storage and data exposure

S3, Blob Storage and Cloud Storage, plus the places teams forget: snapshots shared with every account, backups in a second region, a SAS token in a repository, read as an anonymous user and as a low-privilege identity.

Metadata, pipelines and secrets

The instance metadata service behind an image fetcher, the deploy key printed into a build log, the access key in a pipeline variable. One reachable secret starts most paths on this page.

Kubernetes, containers and serverless

EKS, AKS and GKE: cluster-admin bindings, pod identities and node roles that reach the cloud account, containers that reach the node, and functions whose execution role reads every secret.

Network paths and managed services

Security groups and NSGs open to the world on management ports, peering that flattens segmentation, private endpoints that were never made private, and managed databases reachable from the wrong subnet.

Hybrid trust from on-premises AD

Directory synchronisation, federation and the sync server itself: whether a standard domain user becomes a tenant administrator, and whether a compromised cloud identity flows back into the domain.

Each boundary produces its own question for the test, and its own line in the report.

02 / THE DETAIL

The Attack Paths That Repeat in AWS, Azure and GCP

These are the findings that recur across the cloud environments we assess, from a single account with one cluster to a multi-account organisation synchronised from on premises. Nothing on this list needs an unpatched system; each one is a permission somebody granted.

A long-lived access key in a build log

Created for a deploy script, committed to a repository, printed by a CI job, never rotated, and still attached to iam:PassRole and s3:* on every resource.

A function that runs as administrator

A developer role may create functions and pass any existing role to them. One of those roles carries AdministratorAccess. One invocation returns administrator credentials.

Metadata credentials behind a web form

A server-side request forgery in an image fetcher reaches the metadata service and returns the instance role’s credentials (OWASP Top 10 A10:2021 Server-Side Request Forgery). On AWS, requiring IMDSv2 closes the simple form.

A public snapshot or a readable bucket of backups

A database snapshot shared with all accounts, a SAS token that never expires, a bucket of nightly dumps whose policy names every principal. The data leaves with every API call returning 200.

Cluster-admin for every pod

A default service account bound to cluster-admin, a pod that mounts the node’s root filesystem, a node role that reads every secret. One container becomes the cluster, then the account.

The sync server that holds both sides

The directory sync server holds a domain account that may replicate password hashes (DCSync, MITRE ATT&CK T1003.006) and a cloud account with a privileged directory role. A domain user who reaches it reaches every synced identity.

The finding platform leads remember: a readable build log to the production database in four API calls, with nothing unpatched anywhere on the path.

03 / THE DETAIL

What the Report Has to Prove, and to Whom

A cloud pentest report has three readers. Your platform engineers want the API call and the Terraform change that closes each path. Your auditor wants evidence that an independent party tested the environment and the risk was closed. Your customers want a date, a scope and a signed letter for the questionnaire.

Ours carries all three. Each finding names the CIS Benchmark recommendation it breaks where one applies, and the SOC 2, ISO 27001 or NIST SP 800-53 control it bears on. The executive summary states what a compromised identity could reach in two paragraphs; the retest and the attestation letter close the audit file.

For a SOC 2 audit the pentest is the evidence asked for under CC7.1 and CC4.1. For cardholder data the scope follows PCI DSS requirement 11.4, with 11.4.5 segmentation checks for the CDE accounts. Health data maps to HIPAA 164.308(a)(8). EU entities under NIS2 Article 21(2)(e) and (f) or DORA Article 25 get the report mapped to those articles; designated financial entities add threat-led testing under Article 26.

What each regime expects, and which part of the deliverable answers it.
A cloud architect leaning over a large printed network topology drawing while agreeing the rules of engagement for a cloud pentest

04 / THE DETAIL

Rules of Engagement for Production Cloud Environments

A production tenant is tested under a written agreement your platform lead and your risk owner can both read.

  • Nothing persists. We never delete resources, modify production data or leave a backdoor. Everything we create carries an agreed name prefix and is removed before the report is issued.
  • Availability is protected. Denial-of-service and flooding techniques are excluded, and windows are agreed for anything that touches a production cluster or database.
  • A named contact and a stop condition. One escalation contact on each side, reachable throughout, and a written condition under which testing halts immediately.
  • Evidence handling. Customer data encountered is redacted at capture and destroyed on a documented date. Any live key we obtain is reported the same day for rotation.
  • Provider boundary respected. AWS lists the services you may test without prior approval, Microsoft requires no notification for your own Azure resources, and Google Cloud needs none inside its acceptable use policy. We test your configuration within those terms; the provider’s own infrastructure stays out of scope.

05 / THE DETAIL

How the Engagement Runs

Five steps: price fixed at the first, report inside fourteen days of the third, attestation letter at the fifth.

1

Scoping call

Which accounts or subscriptions, which identity we start from, which boundaries your auditor cares about. Fixed price and timeline in writing within 24 hours.

2

Rules of engagement

Test windows, escalation contacts on both sides, the name prefix for anything we create, and a written stop condition.

3

Manual testing

Senior-led, from the identity you give us outward: escalation chains, storage, pipeline secrets, clusters, network paths and the hybrid trust, each action timestamped against your logs.

4

Report and workshop

Findings register with the API calls and infrastructure-as-code changes that close each path, an executive summary with control mapping, and a live session with your engineers.

5

Retest and attestation

Free retest after you fix, then an attestation letter signed by a named qualified individual for the audit file and the customer questionnaire.

06 / PRICING

Cloud Pentest Pricing

Each scope is a fixed price agreed in writing. Larger or combined scopes are priced in one proposal with volume pricing, and you approve the total before anything starts.

ScopeWhat is coveredTestingPrice
Cloud infrastructureOne AWS, Azure or GCP environment: IAM, storage, secrets, clusters, network7-10 daysFrom $6,000
External perimeterPublic IP ranges, load balancers, management ports, DNS, mail5-7 daysFrom $4,000
Internal network and Active DirectoryInternal ranges plus the privileged path into the tenant7-10 daysFrom $5,000
Web application1 application, all roles7-10 daysFrom $5,000
APIUp to 50 endpoints behind API Gateway or API Management5-7 daysFrom $4,000
SaaS multi-tenant platformTenant isolation in the application and the account beneath it10-14 daysFrom $6,000

Every scope includes the findings register with CLI and infrastructure-as-code remediation, the executive summary with control mapping, the remediation workshop, a free retest and the attestation letter. A CIS Benchmark configuration review without exploitation is described under AWS security assessment and cloud security consulting; the full price list is on the pricing page.

For small projects and ad-hoc work outside our pre-agreed packages or retainers, our standard hourly rate is $460.

07 / THE DETAIL

Cloud Pentest or Vulnerability Scan

A CSPM dashboard and a vulnerability scanner answer one question: what is misconfigured. A pentest answers the other: what a misconfiguration lets an identity do. Auditors ask for both.

RA-5 for the scan, CA-8 for the test: two lines in the audit file, two different deliverables.

08 / THE DETAIL

Who Commissions a Cloud Pentest

SaaS companies on AWS, Azure or GCP preparing for a SOC 2 Type II or ISO 27001 audit
Platform teams that inherited an account built before anyone owned IAM
Companies running EKS, AKS or GKE in production with customer data
Hybrid estates with on-premises Active Directory synchronised into the tenant
Teams responding to a leaked key, a public bucket alert or a questionnaire asking for the last pentest
Acquirers and enterprise buyers who need a cloud-native vendor’s real posture before signing

09 / THE DETAIL

Find Out What One Leaked Key Can Reach

One scoping call. Bring your architecture diagram, your last CSPM export, your auditor’s request, or nothing at all. You will leave with a scope written as questions, a fixed price, and a date for the report.

Scope My Cloud Pentest

10 / THE DETAIL

Book the Scoping Call

Choose a time for your scoping call.

Or visit our contact page ↗

11 / FAQ

Cloud Pentest FAQ

What is a cloud pentest?
A cloud pentest is a manual penetration test of one AWS, Azure or GCP environment that starts from a realistic identity and proves what it can reach: IAM roles that allow privilege escalation, storage and snapshots readable by the wrong principal, instance metadata and pipeline secrets, Kubernetes and serverless, and the hybrid trust from on-premises Active Directory into the tenant. The output is a set of proven attack paths, each with its business consequence and the API calls behind it.
How is a cloud pentest different from a CSPM tool or a vulnerability scan?
A CSPM tool and a scanner read your configuration and flag single items against a benchmark: a public bucket, an open port. A cloud pentest starts from one identity and proves what it can reach by chaining items a scanner scores as low on their own: a developer role with iam:PassRole, a function with an administrator role, a database secret. NIST SP 800-53 lists scanning under RA-5 and penetration testing under CA-8, and a SOC 2 or ISO 27001 auditor asks for both.
Do we need to tell AWS, Azure or Google before you test?
No advance permission is required from any of the three providers. AWS publishes a customer penetration testing policy listing the services you may test without prior approval, EC2, RDS, Lambda and API Gateway among them, and prohibits denial-of-service and flooding techniques. Microsoft’s rules of engagement require no notification for your own Azure resources and forbid any activity against another customer’s tenant. Google Cloud needs no notification provided testing stays within its acceptable use policy.
What access do you need, and do you also test from the outside?
Both. The external part runs from zero access against your public IP addresses, load balancers and exposed management ports. The privilege-escalation part starts from a read-only audit role plus one low-privilege identity of the kind a developer or a CI job holds, because that answers the question your board is really asking: how far a single compromised identity gets.
Is it safe to test our production environment?
Yes, under written rules of engagement agreed before anything starts. We never delete resources, modify production data or create persistent backdoors. Escalation happens in agreed windows, everything we create carries an agreed name prefix and is removed before the report is issued, and every action is timestamped against your logs. A named contact on each side is reachable throughout, and a written stop condition halts testing immediately.
Do you test Kubernetes, containers and serverless functions?
Yes. On EKS, AKS and GKE we test RBAC and cluster-admin bindings, pod identities and node roles that reach the cloud account, and whether a compromised container can reach the node, its metadata endpoint or the host. Lambda, Azure Functions and Cloud Functions are tested for event injection, over-broad execution roles, credentials in environment variables, and function chaining into other services.
Do you test our CI/CD pipelines and repositories?
Yes. We look for long-lived cloud keys in repositories, pipeline variables and build logs, registries an unauthenticated user can write to, and whether the pipeline’s own identity reaches production directly. Where GitHub Actions, GitLab or Azure DevOps federate into the cloud through OIDC, we test the trust condition on the role: one that matches any repository in the organisation hands production to every developer.
Do you test the path from our on-premises Active Directory into the tenant?
Yes, as part of the internal network scope. The server that synchronises on-premises Active Directory into Entra ID or AWS IAM Identity Center holds the keys to both sides: on premises its account may replicate password hashes, and in the tenant it holds a privileged directory role. We test whether a standard domain user can reach that server or its account, with Kerberoasting (MITRE ATT&CK T1558.003) and DCSync (T1003.006) among the techniques, and whether a cloud identity can flow back into the domain.
Which compliance requirements does a cloud pentest satisfy?
SOC 2 auditors expect a penetration test report as evidence under CC7.1 and CC4.1. ISO/IEC 27001:2022 Annex A 8.8 covers management of technical vulnerabilities and A 8.29 security testing. NIST SP 800-53 Rev. 5 control CA-8 is penetration testing and RA-5 is vulnerability monitoring and scanning. PCI DSS v4.0 requirement 11.4 calls for internal and external penetration testing at least every 12 months and after significant changes, with 11.4.5 segmentation testing for the CDE. HIPAA 45 CFR 164.308(a)(8), GDPR Article 32(1)(d), NIS2 Article 21(2)(e) and (f) and DORA Article 25 each expect or accept this kind of testing, and a pentest is accepted assessment evidence for NIST SP 800-171 3.12.1 under CMMC Level 2.
What does the report include, and who is it written for?
Your platform engineers get a findings register with each path reproduced as the API calls behind it, and remediation written as CLI commands and infrastructure-as-code samples. Your auditor gets an executive summary with each finding mapped to the CIS Benchmark recommendation and the SOC 2, ISO 27001, NIST SP 800-53 or PCI DSS control it bears on. Your customers get the attestation letter, signed by a named qualified individual after the free retest.
How long does a cloud pentest take, and what does it cost?
One AWS, Azure or GCP environment runs seven to ten days of testing from $6,000, with the report within fourteen days of the start. The external perimeter and an API of up to 50 endpoints are from $4,000 each, a web application or the internal network with Active Directory from $5,000, and a multi-tenant SaaS platform from $6,000. Combined scopes are priced in one proposal with volume pricing, and you approve the total before anything starts.

12 / THE DETAIL

Related Services

Penetration testing - AWS security assessment - Cloud security consulting - SaaS pentest - API pentest - Network pentest - Active Directory security assessment - SOC 2 compliance - continuous penetration testing with Pentestas