Cloud Config Review for AWS

0xLeeBai
Apr 8, 2024

--

I created a vulnerable server for this lab. The purpose is to test run some of the tools.

Method 1: Testing via Nessus

Nessus > new scan > Audit Cloud Infrastructure

Choose this from Nessus
Enter the Access Key ID and Secret Key
choose either L1 or L2
scan result is similar to CIS benchmark

Method 2: Testing via CloudSploit

enter the virtual environment, then make a copy of the original file.
make the changes in the config.js file.
how to run the scan.
your result in excel.

Method 3: Testing via ScoutSuite

how to run the scan.
your result is saved in here.
issues found in red.
violates the CIS benchmark.
violates the best practice.

--

--

0xLeeBai

床前明月光,疑是地上霜。 举头望明月,低头思故乡。