AWS Penetration Testing: Rules and Scope

Cloud providers used to require advance written permission before any penetration test could touch customer-owned infrastructure. AWS has moved away from that model for most common scenarios, but "most" is doing real work in that sentence.

What AWS currently permits without prior approval

AWS's customer support policy authorizes security testing of a defined list of services you own, without needing to request permission in advance, provided the testing stays within their documented rules. This covers most common EC2, RDS, and Lambda-based testing scenarios that a typical customer would actually want to run.

What is explicitly still prohibited

• DNS zone walking against Route 53 managed zones.
• Denial-of-service testing, simulated or real, without a separate, specific process.
• Testing against infrastructure you do not own or explicitly control within your own account.
• Testing against AWS's own infrastructure, as opposed to resources running on it.

Multi-tenant boundaries are a real, separate concern

Even with a permissive testing policy, a poorly scoped test can accidentally impact shared or adjacent infrastructure, particularly around networking, load balancers, or misconfigured resources that are broader than the customer intended. This is exactly the kind of boundary that requires the same discipline covered in why scope enforcement matters, applied to cloud resource identifiers instead of just IP ranges and domains.

Cloud-specific findings still need cloud-specific checks

A traditional network and application testing methodology does not automatically surface identity and access misconfigurations, storage exposure, or infrastructure-as-code drift, the findings that actually dominate real cloud engagements. See common cloud misconfigurations for what to check specifically.

Other providers differ

Azure and Google Cloud each maintain their own testing policies, with their own specific prohibited activities and notification requirements. Never assume AWS's rules transfer directly to a different provider, confirm the actual current policy for whichever platform is in scope before testing begins.