Belajar Security Tester - Testing Cloud & Infrastructure

#Pendahuluan

Setelah di episode 12 kita menguji mobile apps, pada episode ini kita mendalami cloud & infrastructure — area di mana misconfiguration bisa membocorkan seluruh data organisasi dalam satu click.

#Cloud Misconfiguration

#AWS S3 Bucket

bash

# Cek S3 bucket yang publicly accessible
aws s3 ls s3://target-bucket --acl 2>&1
 
# List bucket contents
aws s3 ls s3://target-bucket --recursive

#GCP / Azure

bash

# GCP: cek IAM policy
gcloud projects get-iam-policy PROJECT_ID
 
# Azure: cek storage accounts
az storage account list

#Cloud Metadata Endpoint

bash

# AWS metadata (dari dalam instance)
curl http://169.254.169.254/latest/meta-data/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
 
# GCP metadata
curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/

Warning

Cloud metadata endpoint adalah target utama attacker. Jika SSRF memungkinkan akses ke 169.254.169.254, attacker bisa mengambil IAM credentials.

#Exposed Services

bash

# Scan port yang terbuka
nmap -sV -p 22,80,443,3306,5432,6379,27017 target-ip
 
# Cek Redis tanpa authentication
redis-cli -h target-ip ping
 
# Cek Elasticsearch tanpa authentication
curl http://target-ip:9200/
 
# Cek MongoDB tanpa authentication
mongosh "mongodb://target-ip:27017"

#IAM & Access Control

bash

# AWS: list policies
aws iam list-policies --scope Local
 
# Cek overly permissive policies
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::ACCOUNT:role/ROLE \
  --action-names s3:GetObject s3:PutObject

#Infrastructure as Code Scanning

bash

# Scan Terraform
tfsec .
checkov -d .
 
# Scan Kubernetes manifests
kube-score Score
polaris audit --audit-path ./k8s/

#Praktik: Cloud Security Assessment

bash

# 1. Scan open ports
nmap -sV target-ip
 
# 2. Check exposed services
curl http://target-ip:9200/
redis-cli -h target-ip ping
 
# 3. Check cloud metadata (jika SSRF tersedia)
curl http://169.254.169.254/latest/meta-data/
 
# 4. Scan IaC
tfsec .
checkov -d .

#Penutup

Cloud metadata: 169.254.169.254 adalah target utama — blokir akses dari aplikasi.
Exposed services: scan port dan test authentication pada service kritis.
IAM: pastikan least privilege principle diterapkan.
IaC scanning: tfsec/checkov untuk menemukan misconfiguration di code.

Di episode 14 selanjutnya kita akan membahas testing Docker/K8s deployments — image scanning, runtime config, exposed ports, dan container security. Sampai jumpa di episode 14!