---
description: Usefull commands - AWS CLI
---

# AWS CLI

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FZ6IuHake4TqwMpZCesey%2Fimage.png?alt=media&#x26;token=11388ab0-822a-4552-ba03-76688d53f366" alt=""><figcaption></figcaption></figure>

Keep track of profiles

```
cat ~/.aws/credentials
```

## Configure a named profile

```
aws configure --profile [profile-name]
```

{% embed url="https://docs.aws.amazon.com/cli/latest/reference/configure/" %}

Or

```
aws configure set aws_access_key_id [key-id] --profile [profile-name]
aws configure set aws_secret_access_key [key-id] --profile [profile-name]
aws configure set aws_session_token [token] --profile [profile-name]
aws sts get-caller-identity --profile [profile-name]
```

Or

```
$ export AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID>
$ export AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY>
$ export AWS_SESSION_TOKEN=<AWS_SESSION_TOKEN>
$ aws configure
```

{% embed url="https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html" %}

## Information about configured identity

```
aws sts get-caller-identity --profile [profile-name]
```

{% embed url="https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html" %}

## Account ID

```
aws sts get-access-key-info --access-key-id <access-key> --profile <profile>
```

## Stored Credentials

Windows

```
C:\Users\UserName\.aws
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FIoOvUT6oL4dZNpz8LYW6%2Fimage.png?alt=media&#x26;token=2e7eebab-6d1f-4251-a2b4-d839105a0991" alt=""><figcaption></figcaption></figure>

Linux

```
/home/UserName/.aws
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FQSMcxA82omBPqEqsp94s%2Fimage.png?alt=media&#x26;token=4549ba57-9632-4604-8809-896c2c066c3d" alt=""><figcaption></figcaption></figure>

```
cat credentials
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FJuP7ZzstsKHqjQqVJwz3%2Fimage.png?alt=media&#x26;token=97c79e31-f8e4-4275-8e1d-4fbbc347f16c" alt=""><figcaption></figcaption></figure>

## Enumeration - Users

```
aws iam list-users

# With profile
aws iam list-users --profile [profile-name]
```

List the IAM groups that the specified IAM user belongs to :

```
aws iam list-groups-for-user --user-name [user-name]
```

List all manages policies that are attached to the specified IAM user :

```
aws iam list-attached-user-policies --user-name [user-name]

# With profile
aws iam list-attached-user-policies --user-name [user-name] --profile [profile-name]

aws iam get-policy --policy-arn arn:aws:iam::427648302155:policy/Policy

aws iam get-policy-version --profile [☺profile] --policy-arn arn:aws:iam::427648302155:policy/Policy --version-id v1
```

Lists the names of the inline policies embedded in the specified IAM user :

```
aws iam list-user-policies --user-name [user-name]
```

Get policy

```
aws iam get-user-policy --user-name [user-name] --policy-name [policy-name]
```

## Enumeration - Groups

IAM Groups

```
aws iam list-groups
```

All users in a group

```
aws iam get-group --group-name [group-name]
```

All managed policies that are attached to the specified IAM Group

```
aws iam list-attached-group-policies --group-name [group-name]
```

Names of the inline policies embedded in the specified IAM Group

```
aws iam list-group-policies --group-name [group-name]
```

## Enumeration - Roles

List of IAM Roles

```
aws iam list-roles
```

All managed policies that are attached to the specified IAM role

```
aws iam list-attached-role-policies --role-name [ role-name]
```

Names of the inline policies embedded in the specified IAM role

```
aws iam list-role-policies --role-name [ role-name]
```

## Enumeration - Policies

List of all iam policies

```
aws iam list-policies
```

Information about the specified managed policy

```
aws iam get-policy --policy-arn [policy-arn]

# With profile
aws iam get-policy --policy-arn [policy-arn] --profile [profile-name]
```

Information about the versions of the specified manages policy

```
aws iam list-policy-versions --policy-arn [policy-arn]
```

Information about the specified version of the specified managed policy

```
aws iam get-policy-version --policy-arn [policy-arn] --version-id [version-id]
# Example
aws iam get-policy-version --policy-arn arn:aws:iam::427648302155:policy/Policy --version-id v4

# With profile
aws iam get-policy-version --policy-arn [policy-arn] --version-id [version-id] --profile [profile-name]
```

One of the permissions is `iam:CreatePolicyVersion` ? Use this to create a new version of the attached policy with privileged access

```
aws iam create-policy-version --policy-arn [policy-arn] --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}' --set-as-default --profile [profile-name]
```

Specified inline policy document that is embedded on the specified IAM user / group / role

```
aws iam get-user-policy --user-name user-name --policy-name [policy-name]
aws iam get-group-policy --group-name group-name --policy-name [policy-name]
aws iam get-role-policy --role-name role-name --policy-name [policy-name]
```

## Enumeration - Cloud Services (EC2, S3 etc.) in an Organization AWS Account

```
aws ec2 describe-instances --profile [profile-name]
```

```
aws ec2 describe-instances --filters Name=instance-state-name,Values=running --query 'Reservations[].Instances[].[Tags[?Key==`Name`].Value | [0],InstanceId,Platform,State.Name,PrivateIpAddress,PublicIpAddress,InstanceType,PublicDnsName,KeyName]'
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FsIQCURLLOEodQLwQk3Sv%2Fimage.png?alt=media&#x26;token=371af465-1b18-4c0c-ac39-6205ae71291c" alt=""><figcaption></figcaption></figure>

This might not return any results if you aren't in the same region. -> Run pacu `ec2__enum` module

## Enumeration - Get Bucket Policy

```
aws s3api get-bucket-policy --bucket [bucket-name]
# Example
# aws s3api get-bucket-policy --bucket hl-it-admin
```

## DynamoDB

```
aws dynamodb list-tables

aws dynamodb describe-table --table [table-name]
```

## CodeCommit

```
aws codecommit list-repositories

aws codecommit get-repository --repository-name [repo-name]

# List branches
aws codecommit list-branches --repository-name [repo-name]

# Get details
aws codecommit get-branch --repository-name [repo-name] --branch-name dev

# Get the parent commit
aws codecommit get-commit --repository-name [repo-name] --commit-id [commit-id]

# Find the files that changed between commits
aws codecommit get-differences --repository-name [repo-name] --before-commit-specifier [parent-id] --after-commit-specifier [commit-id]

# Download file
aws codecommit get-file --repository-name [repo-name] --commit-specifier [commit-id] --file-path [file-path]
```

## Interesting Book

{% content-ref url="../../interesting-books" %}
[interesting-books](../../interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**Advanced Penetration Testing: Hacking AWS 2**](https://www.amazon.fr/dp/B0849Z2TLJ?tag=0xss0rz-21)\
  This book delves deeper into analyzing the security of various AWS services and shows techniques and tactics used by an attacker to breach an AWS environment
* [**Hands-On AWS Penetration Testing with Kali Linux**](https://www.amazon.fr/dp/B07C61YYJ4?tag=0xss0rz-21)\
  Set up a virtual lab and pentest major AWS services, including EC2, S3, Lambda, and Cloud
