CloudFox Tutorial: Automating Cloud Penetration Testing

Cloud penetration testing requires rapidly understanding unfamiliar infrastructure. When assessing complex environments, security engineers need tools that automate discovery without manually clicking through endless cloud management consoles. CloudFox is an open-source command-line tool created by BishopFox to help offensive security professionals gain immediate situational awareness. By automating the extraction of configuration data, CloudFox generates actionable attack paths and target lists that analysts can further probe using traditional network scanners, as detailed in our comprehensive Nmap cheat sheet.

What Is CloudFox?

Maintained on the official BishopFox CloudFox GitHub repository, the framework is designed to be executed by a principal with limited, read-only permissions. Its primary objective is to help penetration testers identify exploitable attack paths during simulated compromise scenarios.

CloudFox answers critical infrastructure questions within seconds:

• Which regions are actively utilized, and what is the rough resource count?
• Are there cleartext secrets lurking in EC2 userdata or service-specific environment variables?
• What exact actions and permissions does a compromised principal have?
• Which IAM role trust policies are overly permissive or allow lateral cross-account assumption?
• What endpoints, hostnames, and IP addresses are exposed to the public internet versus internally within the Virtual Private Cloud (VPC)?

Supported Cloud Providers and Modules

CloudFox is heavily optimized for Amazon Web Services (AWS) with 15 dedicated enumeration modules. It also includes preliminary (alpha) support for Microsoft Azure, specifically targeting compute instances and role-based access control (RBAC) mapping across tenants. Support for Google Cloud Platform (GCP) and Kubernetes is planned for future releases.

Installing the Framework

Because it is written in Go, CloudFox compiles easily across Linux, macOS, and Windows. While you can download pre-compiled binaries from the GitHub releases page, compiling from the source ensures you have the latest module updates.

# Clone the repository and build the binary
git clone https://github.com/BishopFox/cloudfox.git
cd ./cloudfox
go build .
./cloudfox

Prerequisites and IAM Permissions

Running the AWS modules requires an installed AWS CLI and properly configured authentication mechanisms, such as local profiles, environment variables, or EC2 metadata retrieval. You can pass a list of profiles using the -l flag or scan all stored profiles simultaneously with the -a flag.

For optimal results without triggering excessive permission errors, the principal executing CloudFox should have the AWS managed SecurityAudit policy attached, alongside the custom CloudFox policy provided in the documentation. Using the AdministratorAccess policy works perfectly, but acquiring that level of access usually means the penetration test is already complete.

Basic Usage and Core Commands

CloudFox is entirely modular, allowing you to run specific checks individually. However, for initial reconnaissance, the all-checks command executes every available module using sane defaults.

cloudfox aws --profile [profile-name] all-checks

For more targeted audits, CloudFox provides several powerful standalone modules:

• endpoints: Enumerates service endpoints to identify unauthenticated or misconfigured interfaces from both internal and external network positions.
• env-vars: Extracts environment variables from App Runner, ECS, Lambda, and SageMaker to locate hardcoded secrets.
• iam-simulator: Leverages the AWS IAM policy simulator logic to evaluate access rights effectively.
• role-trusts: Analyzes IAM role trust policies to uncover overly permissive relationships and lateral movement opportunities.
• instances: Gathers comprehensive data on EC2 instances, generating formatted loot files that you can feed directly into port scanners for deeper service enumeration.

By producing clean, organized output directories and handling the complex web of cloud permissions automatically, CloudFox significantly reduces the manual triage time required during modern cloud security assessments.