Lesson 09 — Cloud Compute Attacks

Learning Objectives

By the end of this lesson, you will be able to:

Understand cloud compute security.
Learn how attackers compromise cloud compute workloads.
Identify common compute attack vectors.
Understand metadata service attacks.
Assess compute security across AWS, Azure and Google Cloud.
Apply enterprise compute security best practices.

Introduction

Compute resources are the backbone of cloud infrastructure.

Almost every enterprise application eventually runs on compute resources such as:

Amazon EC2
Azure Virtual Machines
Google Compute Engine
Auto Scaling Groups
Virtual Machine Scale Sets
Managed Instance Groups

Compromising compute resources often allows attackers to pivot deeper into an enterprise cloud environment.

What are Cloud Compute Services?

Cloud compute services provide virtual machines and processing resources that host enterprise workloads.

Major cloud providers offer:

Cloud Provider	Compute Service
AWS	Amazon EC2
Azure	Azure Virtual Machines
Google Cloud	Compute Engine

These services are highly configurable, making secure configuration essential.

Why Attackers Target Compute Resources

Compromised compute instances may provide access to:

IAM Credentials
Sensitive Data
Internal Applications
Kubernetes Clusters
Databases
CI/CD Pipelines
Storage Buckets
Secrets
Network Connectivity

A single compromised virtual machine can become a launching point for broader attacks.

Cloud Compute Attack Lifecycle

Compute Discovery

↓

Service Enumeration

↓

Operating System Enumeration

↓

Credential Discovery

↓

Metadata Service Access

↓

Privilege Escalation

↓

Lateral Movement

↓

Data Access

↓

Persistence

Enterprise Compute Attack Surface

Internet

↓

Load Balancer

↓

Virtual Machine

↓

Operating System

↓

Applications

↓

Metadata Service

↓

IAM Role

↓

Cloud APIs

↓

Sensitive Resources

Common Compute Attack Vectors

Cloud compute attacks commonly involve:

Unpatched operating systems
Weak SSH/RDP configurations
Exposed management ports
Metadata service abuse
IAM role compromise
Weak Security Groups
Local privilege escalation
Credential theft
Malware
Web application compromise

Attack 1 — Publicly Exposed Instances

Misconfigured Security Groups may expose:

SSH (22)
RDP (3389)
Database ports
Application ports
Administrative interfaces

Example:

Internet

↓

EC2 Instance

↓

SSH

↓

Weak Credentials

↓

Server Access

Attack 2 — Weak Security Groups

Example:

0.0.0.0/0

↓

Port 22

↓

Linux Server

Problems:

Internet exposure
Password attacks
Increased attack surface

Restrict management access whenever possible.

Attack 3 — Unpatched Operating Systems

Common risks include:

Remote Code Execution
Privilege Escalation
Kernel Vulnerabilities
Unsupported Operating Systems

Regular patching is essential for reducing risk.

Attack 4 — Metadata Service Abuse

Cloud virtual machines expose metadata services that provide instance information and temporary credentials.

Example endpoint:

169.254.169.254

Attackers may attempt to retrieve:

IAM Role Credentials
Instance Identity
Region Information
User Data
Access Tokens

Protect workloads and use modern metadata service protections where available.

AWS EC2 Metadata Service

AWS provides:

IMDSv1
IMDSv2

IMDSv2 introduces session-oriented requests that help mitigate certain attack techniques, such as Server-Side Request Forgery (SSRF).

Assessment checklist:

IMDSv2 enforced
IMDSv1 disabled (where appropriate)
Minimal IAM role permissions

Attack 5 — IAM Role Abuse

Example:

Compromised EC2

↓

IAM Role

↓

S3 Access

↓

Sensitive Files

Attackers often target instance roles because they provide temporary credentials.

Attack 6 — Credential Discovery

Attackers search for:

AWS CLI credentials
Azure CLI credentials
GCP credentials
SSH Keys
Private Keys
API Keys
Configuration Files
Environment Variables

Poor credential management significantly increases risk.

Attack 7 — Privilege Escalation

Examples include:

Local administrator access
Linux sudo abuse
Misconfigured services
IAM privilege escalation
Kubernetes access

Privilege escalation allows attackers to expand their control.

Attack 8 — Lateral Movement

After compromising one workload, attackers attempt to reach:

Additional virtual machines
Kubernetes clusters
Databases
Storage
Internal APIs
CI/CD systems

Network segmentation helps reduce lateral movement opportunities.

Attack 9 — Persistence

Persistence techniques include:

New administrator accounts
Scheduled tasks
Startup services
SSH authorized keys
Backdoor applications
Additional IAM users

Persistence enables attackers to survive remediation attempts.

Attack 10 — Compute Resource Hijacking

Compromised compute instances may be abused for:

Cryptocurrency mining
Botnet participation
Proxy services
Distributed attacks
Spam campaigns

Unexpected resource consumption may indicate compromise.

Compute Enumeration

Review:

Instance inventory
Public IP addresses
Operating systems
Security Groups
IAM Roles
Instance profiles
Running services
Installed software
Metadata configuration
Patch levels

AWS EC2 Assessment

Review:

EC2 instances
AMIs
Security Groups
Elastic IPs
IAM Roles
EBS encryption
User Data
Instance metadata settings
Auto Scaling Groups

Example commands:

aws ec2 describe-instances

aws ec2 describe-security-groups

aws ec2 describe-images

Azure Virtual Machine Assessment

Review:

Virtual Machines
Network Security Groups
Managed Identities
Azure Disk Encryption
Azure Bastion
Update Management
Defender for Cloud recommendations

Example:

az vm list

az vm show \
  --name VM-NAME \
  --resource-group RESOURCE-GROUP

Google Compute Engine Assessment

Review:

Compute instances
Firewall rules
Service Accounts
OS Login
Shielded VM
Instance metadata
Boot disk encryption

Example:

gcloud compute instances list

gcloud compute firewall-rules list

Enterprise Compute Assessment Checklist

Review:

Public IP exposure
Open management ports
Security Groups / NSGs
Firewall rules
Patch levels
IAM Roles
Metadata protection
Disk encryption
Endpoint protection
Logging

Enterprise Scenario

CloudNova Technologies operates:

420 EC2 instances
110 Azure Virtual Machines
95 Google Compute Engine instances

Assessment findings:

37 EC2 instances expose SSH to the internet.
14 Windows servers expose RDP publicly.
IMDSv1 remains enabled on multiple EC2 instances.
Several instance roles have full administrator permissions.
Outdated Linux kernels are present on legacy workloads.
Local administrator passwords are shared across multiple servers.

These issues significantly increase the organization’s attack surface.

Enterprise Attack Path

Internet

↓

Public EC2

↓

Web Application

↓

Remote Code Execution

↓

Metadata Service

↓

IAM Role

↓

Amazon S3

↓

Sensitive Data

Enterprise Deliverables

Professional compute security assessments should include:

Compute Inventory
Security Group Review
Patch Assessment
IAM Role Review
Metadata Configuration Review
Encryption Assessment
Operating System Hardening Review
Risk Register
Executive Summary

Defensive Controls

Organizations should implement:

Least Privilege IAM
IMDSv2 (AWS)
Private management access
Multi-Factor Authentication (MFA)
Endpoint Detection & Response (EDR)
Patch Management
Disk Encryption
Network Segmentation
Bastion Hosts
Continuous Monitoring

Best Practices

Remove unnecessary public IP addresses.
Restrict SSH and RDP access.
Enforce IMDSv2 where supported.
Apply operating system patches promptly.
Use least privilege IAM roles.
Encrypt storage volumes.
Monitor compute workloads continuously.
Harden operating system configurations.
Enable endpoint protection.
Rotate credentials regularly.

Common Mistakes

Avoid:

Exposing management ports to the internet.
Using administrator IAM roles for workloads.
Running unsupported operating systems.
Ignoring metadata service protections.
Reusing administrator passwords.
Disabling security monitoring.
Leaving workloads unpatched.

Knowledge Check

1. Why are compute resources attractive targets?

Answer: Compute resources often host applications, credentials, cloud identities and network access, making them valuable entry points for attackers.

2. Why is the metadata service important during a cloud security assessment?

Answer: Metadata services may provide temporary credentials and instance information. If improperly protected, attackers can use them to obtain cloud access.

3. What is the purpose of IMDSv2 on AWS?

Answer: IMDSv2 strengthens the EC2 Instance Metadata Service by requiring session-oriented requests, helping mitigate attacks such as SSRF against instance metadata.

4. Why should penetration testers review IAM roles attached to compute instances?

Answer: Overly permissive IAM roles can allow attackers who compromise a workload to access additional cloud resources and escalate their privileges.

5. What security controls reduce compute attack risk?

Answer: Least privilege IAM, operating system patching, private management access, endpoint protection, metadata protection, disk encryption and continuous monitoring all reduce compute-related risks.

Key Takeaways

Cloud compute resources are high-value targets because they often provide access to identities, applications and sensitive data.
Metadata services and workload identities are critical assessment areas.
Secure network configuration, patch management and least privilege significantly reduce compute-related risks.
Professional assessments evaluate both the operating system and cloud-native configurations.
Compute security is a shared responsibility that requires continuous monitoring and hardening.

What’s Next?

In the next lesson, we will explore Lesson 10 — Container & Kubernetes Attacks, where you will learn how attackers compromise containers, abuse Kubernetes workloads, exploit RBAC weaknesses and move laterally within cloud-native environments.