312-50 Question 445
Single answer▪ Cloud HackingDuring an authorized assessment of a company's AWS environment, you gain limited code-execution access on an EC2 instance that hosts a web application. The instance uses an IAM role to access other AWS resources. Your objective is to determine whether the instance role is overprivileged and could be abused for lateral movement, without using stolen long-term keys or causing service disruption. Which action is the MOST appropriate next step?
- A
Query the Instance Metadata Service (IMDS) to retrieve temporary role credentials, then use AWS API calls such as sts:GetCallerIdentity and permission-enumeration attempts within the authorized scope
- B
Run a password-spraying attack against AWS Management Console users because IAM roles cannot be used from an EC2 instance for API access
- C
Extract the root account access keys from /root/.aws/credentials and use them to test whether the account has administrator privileges
- D
Modify the instance's security group to allow inbound SSH from the Internet so you can perform a more complete manual review of the host
Show answer and explanation
Correct answer: A
Explanation
In AWS, an EC2 instance can be associated with an IAM role, and workloads on that instance can obtain temporary security credentials from the EC2 Instance Metadata Service (IMDS). For a CEH-style cloud-hacking scenario, a realistic and appropriate post-compromise step is to inspect whether the role can be abused for privilege escalation or lateral movement by retrieving the temporary credentials, confirming the identity with sts:GetCallerIdentity, and then performing tightly scoped permission enumeration. This is more appropriate than attacking unrelated identities, searching for unlikely long-term root keys, or making unnecessary infrastructure changes. Relevant AWS documentation includes guidance on IAM roles for Amazon EC2, use of temporary security credentials, and the EC2 Instance Metadata Service. From a defensive best-practice perspective, organizations should enforce least privilege on IAM roles, prefer IMDSv2, monitor role usage with CloudTrail, and regularly review permissions to reduce the impact of instance compromise.
- A. Correct.
Correct. On an EC2 instance, applications commonly obtain temporary credentials for the attached IAM role through the EC2 Instance Metadata Service at 169.254.169.254. In an authorized cloud security assessment, retrieving those temporary credentials and validating identity with sts:GetCallerIdentity is a standard, low-impact way to determine what principal you are operating as. From there, carefully scoped enumeration of allowed AWS API actions helps identify whether the role is overprivileged and whether it could be abused for lateral movement. This reflects real-world cloud attack paths and aligns with AWS's documented use of IAM roles and temporary credentials for EC2 workloads.
- B. Incorrect.
Incorrect. This option reflects a common misconception. EC2 instances absolutely can use IAM roles for AWS API access via temporary credentials delivered by IMDS. Password spraying against console users is a different attack path, is noisier, and is not the most appropriate next step when you already have code execution on a role-attached instance and want to assess role abuse potential with minimal disruption.
- C. Incorrect.
Incorrect. AWS root access keys are not normally stored on an EC2 instance, and relying on finding root credentials in /root/.aws/credentials is both unrealistic and poor assessment methodology. More importantly, the scenario explicitly calls for avoiding stolen long-term keys. The proper cloud-specific approach is to use the instance role's temporary credentials if present.
- D. Incorrect.
Incorrect. Changing a security group to expose SSH creates unnecessary risk and modifies the target environment in a way that is not required to evaluate IAM role abuse. It also does not directly answer the cloud-hacking objective of determining whether the attached role is overprivileged. Best practice in an authorized assessment is to minimize environmental changes and use the least disruptive method that achieves the test objective.