> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/cloud/aws/enumeration.md).

# Enumeration

## Finding Permissions

As an authenticated user, you can perform a brute force attack to find permissions granted to you. This can be achieved using a tool like [aws-enumerator](https://github.com/shabarkin/aws-enumerator) or with the framework [Pacu](https://github.com/RhinoSecurityLabs/pacu). Make sure to check for permissions in **all regions!**

```
./aws-enumerator cred -aws_access_key_id AKIA***********XKU -aws_region us-west-2 -aws_secret_access_key kIm6m********************5JPF
./aws-enumerator enum -services all
./aws-enumerator dump -services all

run iam__bruteforce_permissions --region [REGION NAME]
```

Keep in mind that these permissions are AWS functions, and not necessarily fine-grained. **You may be able to access an S3 bucket or other specific resource**, but that won't be revealed to you from brute-forcing functions.

## IAM

The AWS CLI allows you to query privilege and user information. Please note that you will need **the correct permissions** to view IAM policies, either inline or managed.

```
aws iam get-user # Whoami
aws iam list-access-keys # Keys on account
aws iam list-users # All users
aws iam list-attached-user-policies --user-name [username] # Managed policies
aws iam list-user-policies --user-name [username] # Inline policies
aws iam get-user-policy --user-name [username] --policy-name [policyname] # Policy details
```