Lesson 04 — Amazon VPC Enumeration

Learning Objectives

By the end of this lesson, you will be able to:

Understand Amazon VPC architecture.
Enumerate AWS networking components.
Identify public and private resources.
Assess Security Groups and Network ACLs.
Review route tables and internet connectivity.
Understand AWS network attack paths.
Perform enterprise VPC security assessments.

Introduction

Every AWS resource communicates through networking.

Whether it is:

Amazon EC2
Amazon RDS
Amazon EKS
AWS Lambda
Amazon ECS

they all rely on the Amazon Virtual Private Cloud (VPC).

Understanding AWS networking is essential because attackers frequently exploit:

Internet-facing resources
Weak Security Groups
Misconfigured Route Tables
Public Subnets
Open Management Ports
VPC Peering
Transit Gateway Misconfigurations

Professional Cloud Penetration Testers always assess network architecture before attempting deeper security testing.

Enterprise Scenario

CloudNova Technologies has been hired to perform a security assessment for FinSecure Bank Ltd.

The organization operates:

18 VPCs
5 AWS Regions
Shared Networking
Amazon EKS
Public APIs
Internet-facing Applications
VPN Connectivity
Transit Gateway

Your objective is to determine whether the enterprise network architecture is secure and identify potential attack paths.

Amazon VPC Overview

Amazon VPC provides isolated networking for AWS resources.

Typical components include:

Amazon VPC

│

├── Public Subnets

├── Private Subnets

├── Route Tables

├── Internet Gateway

├── NAT Gateway

├── Security Groups

├── Network ACLs

├── VPC Endpoints

└── Transit Gateway

Each component should be reviewed during a penetration test.

Typical Enterprise AWS Network

Internet

↓

Internet Gateway

↓

Public Subnet

↓

Load Balancer

↓

Private Subnet

↓

Amazon EC2

↓

Amazon RDS

↓

Amazon EKS

↓

Private Services

This layered architecture limits direct internet exposure.

Public vs Private Subnets

Public Subnet

Resources have a route to an Internet Gateway.

Examples:

Load Balancers
Bastion Hosts
Web Servers

Private Subnet

Resources do not have direct internet access.

Examples:

Databases
Kubernetes Worker Nodes
Internal APIs
Backend Services

Production workloads should generally reside in private subnets.

Internet Gateway

The Internet Gateway (IGW) enables communication between a VPC and the internet.

Review:

Attached VPC
Public routes
Internet-facing workloads

Questions:

Which resources are publicly accessible?
Is internet access necessary?

NAT Gateway

A NAT Gateway allows private resources to access the internet without exposing them directly.

Example:

Private EC2

↓

NAT Gateway

↓

Internet

Verify:

Public Elastic IP
Route Tables
Outbound access

Route Tables

Route Tables determine how traffic flows through a VPC.

Example:

Destination	Target
10.0.0.0/16	Local
0.0.0.0/0	Internet Gateway

Review:

Default routes
Private routes
Transit Gateway routes
VPN routes

Incorrect routing can unintentionally expose private workloads.

Security Groups

Security Groups act as stateful virtual firewalls.

They control:

Inbound traffic
Outbound traffic

Example:

Port	Source	Purpose
80	0.0.0.0/0	HTTP
443	0.0.0.0/0	HTTPS
22	Admin Network	SSH

Avoid exposing management ports to the internet.

Network ACLs

Network ACLs provide stateless subnet-level filtering.

Unlike Security Groups:

Rules are evaluated in order.
Both inbound and outbound rules must be configured.

Review:

Allow rules
Deny rules
Public access
Database protection

VPC Peering

VPC Peering enables communication between VPCs.

Example:

Development VPC

↓

VPC Peering

↓

Production VPC

Review:

Trust boundaries
Routing
Security Group rules

Poorly designed peering can enable lateral movement.

Transit Gateway

Large enterprises often connect multiple VPCs using AWS Transit Gateway.

Development

↓

Transit Gateway

↓

Production

↓

Shared Services

↓

Security Account

Review:

Connected VPCs
Route propagation
Segmentation
Access controls

VPC Endpoints

VPC Endpoints allow private communication with AWS services.

Examples:

Amazon S3
DynamoDB
Secrets Manager
Systems Manager

Review:

Endpoint Policies
Private DNS
Allowed principals

Enterprise Network Attack Surface

Professional penetration testers review:

Public EC2 Instances
Load Balancers
Bastion Hosts
Security Groups
Public APIs
VPN Gateways
Internet Gateways
Transit Gateway
Route Tables
VPC Endpoints

These components often define the initial attack surface.

Enumeration Commands

List VPCs

aws ec2 describe-vpcs

List Subnets

aws ec2 describe-subnets

List Route Tables

aws ec2 describe-route-tables

List Security Groups

aws ec2 describe-security-groups

List Network ACLs

aws ec2 describe-network-acls

List Internet Gateways

aws ec2 describe-internet-gateways

List NAT Gateways

aws ec2 describe-nat-gateways

List VPC Endpoints

aws ec2 describe-vpc-endpoints

List Transit Gateways

aws ec2 describe-transit-gateways

Network Attack Path Example

Internet

↓

Public EC2

↓

Security Group

↓

Private Subnet

↓

Amazon EKS

↓

IAM Role

↓

Amazon S3

↓

Sensitive Data

Network exposure often provides the first step in a larger cloud attack chain.

Enterprise Assessment Workflow

Professional consultants generally follow this process.

Enumerate VPCs

↓

Review Subnets

↓

Review Route Tables

↓

Review Internet Access

↓

Review Security Groups

↓

Review Network ACLs

↓

Review Transit Gateway

↓

Review VPC Endpoints

↓

Identify Attack Paths

↓

Document Findings

Common Enterprise Findings

Frequently observed issues include:

Public EC2 instances
SSH open to the internet
RDP exposed publicly
Wide-open Security Groups (0.0.0.0/0)
Public databases
Missing subnet segmentation
Weak Transit Gateway routing
Unrestricted VPC Peering
Missing Network ACL restrictions
Unprotected Bastion Hosts

Security Best Practices

Place databases in private subnets.
Restrict SSH and RDP access.
Apply least privilege Security Group rules.
Review Network ACLs regularly.
Minimize internet-facing resources.
Use VPC Endpoints for AWS service access.
Segment environments using separate VPCs.
Monitor network traffic with VPC Flow Logs.

Common Mistakes

Avoid:

Exposing management ports to the internet.
Using 0.0.0.0/0 unnecessarily.
Placing databases in public subnets.
Ignoring Transit Gateway routes.
Allowing unrestricted VPC Peering.
Overlooking outbound Security Group rules.
Failing to monitor VPC Flow Logs.

Knowledge Check

1. What is the purpose of an Amazon VPC?

Answer: An Amazon VPC provides a logically isolated virtual network where AWS resources can communicate securely using customer-defined networking configurations.

2. What is the difference between a Security Group and a Network ACL?

Answer: Security Groups are stateful firewalls that operate at the instance level, while Network ACLs are stateless filters that operate at the subnet level.

3. Why are public subnets considered higher risk?

Answer: Public subnets have routes to an Internet Gateway, making resources potentially accessible from the internet if security controls are misconfigured.

4. Why should penetration testers review Route Tables?

Answer: Route Tables determine network traffic flow. Misconfigured routes can expose private resources or create unintended connectivity between environments.

5. Why are Transit Gateways important during enterprise assessments?

Answer: Transit Gateways connect multiple VPCs and networks. Weak segmentation or routing can enable attackers to move laterally across enterprise environments.

Key Takeaways

Amazon VPC forms the networking foundation of AWS environments.
Network assessments should include VPCs, subnets, routing, gateways, Security Groups and Network ACLs.
Public exposure, weak segmentation and excessive connectivity are common enterprise risks.
Network enumeration helps identify attack paths before exploitation begins.
Proper VPC design significantly reduces the likelihood and impact of cloud attacks.

What’s Next?

In the next lesson, you will explore Amazon EC2 Exploitation, learning how attackers assess EC2 instances, abuse instance metadata, identify insecure configurations and understand common EC2 attack techniques used during enterprise AWS penetration testing.

➡️ Next Lesson: Lesson 05 — Amazon EC2 Exploitation