Skip to content

Cloud penetration testing (AWS, Azure, GCP)

A cloud penetration test checks whether your AWS, Azure or Google Cloud environment can be misused to reach data or take over resources. Mr Cyber reviews identities, permissions, network exposure, storage and logging against the CIS Benchmarks, then tests the paths that matter by hand, at a fixed price, with a free retest.

Fixed price from €3,300 · 4 test days · retest included

See my fixed price

Prefer to talk first? Book a call

Storage assets logs backups Workload VM web-01 Role app-runtime Policy on role app-runtime allow storage:Read on * all 3 buckets needed: assets
A web server’s role may read every storage bucket, backups included.
  • 4–8 test days4 test days in the starting price
  • CIS Benchmarks+ 4 more standards
  • Report + debriefwithin 5 business days
  • Free retestwithin 60 days

Who it’s for

  • SaaS companies running their product on AWS, Azure or Google Cloud
  • Companies that moved servers or data to the cloud and want a second opinion
  • Teams preparing for ISO 27001, SOC 2, NIS2, TISAX or BSI C5 questions from customers
  • Companies after a merger, a new landing zone or a fast-growing account setup

What we test

Identities & permissions

  • Users, roles, service accounts and their rights
  • Paths from limited access to admin rights
  • MFA, access keys and federation

Configuration

  • Settings against the CIS Benchmarks
  • Security services, policies and guardrails
  • Separation between accounts, subscriptions and projects

Network & exposure

  • Services reachable from the internet
  • Network segmentation and firewall rules
  • Management interfaces and remote access

Data & secrets

  • Storage buckets, databases and backups
  • Encryption and key management
  • Secrets in code, pipelines and configuration

Workloads & detection

  • Virtual machines, containers, Kubernetes and serverless functions
  • CI/CD access to the cloud
  • Logging, alerting and audit trails
See my fixed price

Prefer to talk first? Book a call

Also covered. In the same test, at no surcharge.

Microsoft 365 & Entra ID

Mail, files and identities in Microsoft 365, checked against the CIS Microsoft 365 Foundations Benchmark. We look at admin roles, MFA and conditional access, guest access, sharing in SharePoint, OneDrive and Teams, and mail protection. Google Workspace is covered the same way.

No surcharge Add to my request

Kubernetes & containers

Managed or self-hosted clusters, checked against the CIS Kubernetes Benchmark. We look at cluster access and RBAC, separation between namespaces and workloads, secrets, images and audit logging, and test how far a compromised container could get.

No surcharge Add to my request

No extra fee for the topic itself. If it needs more test days, the quote shows them upfront.

How we test your cloud. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price
4
business days to the report
5
days for the free retest
60

Typically 4–8 testing days, depending on accounts, services and workloads in scope.

  1. Phase 1

    Scope & start date

    Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

    You pick the date

  2. Phase 2

    Account & IAM review

    Identities, roles and permissions reviewed.

    Test day 1

  3. Phase 3

    Exposure testing

    Public exposure and misconfigurations tested by hand.

    From test day 2

  4. Phase 4

    Report & debrief

    Audit-ready report and ticket file, then a call.

    Within 5 business days

  5. Phase 5

    Free retest

    Your fixes tested again and confirmed in writing.

    Within 60 days

Methodology & standards

  • CIS Benchmarks (AWS, Azure, Google Cloud)
  • MITRE ATT&CK (Cloud)
  • PTES
  • NIST SP 800-115
  • CVSS 3.1

How we test cloud environments

We combine two views. First a configuration review with read-only access, checked against the CIS Benchmarks for your provider. Then manual testing of the paths that matter: from the internet, from a compromised workload or from a user with limited rights to your data.

Within the providers’ rules

AWS, Microsoft Azure and Google Cloud publish rules for security testing. Every test stays within them, and the scope is agreed with you in writing before the start.

Critical findings don’t wait for the report

If we find something critical during testing, such as publicly readable data, you hear from us the same day.

Prioritised for your team

Each finding names the affected resources, gets a CVSS 3.1 score (4.0 on request) and a business-risk rating, and tells your platform team what to fix first.

What you get

  • Executive summary for management and auditors
  • Every finding with affected resources, evidence and fix guidance
  • CIS Benchmark results per account or subscription
  • CVSS 3.1 scoring plus business-risk rating and remediation priorities
  • Debrief call with your cloud and platform team
  • Free retest and updated report

Always included

  • Free retest within 60 days
  • Debrief call with your team
  • NDA, DPA and testing authorisation with the offer
  • Critical findings reported the same day
  • Testing stops at any time on your call
  • Audit-ready report (PDF)
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price See the report
Pentest report · Admin & Söhne GmbH · MC-2026-021
Risk: High CVSS 3.1 · 7.5 Open · retest included

Invoice storage readable by anyone on the internet

Cloud storage bucket “adminsoehne-invoices” (AWS, eu-central-1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

All customer invoices are saved as PDF files in a cloud storage bucket. The bucket is set to “public”, so anyone can list its contents and download every invoice without logging in. The setting was probably switched on to make invoice links in emails work.

Steps to reproduce

  1. Open an invoice link from a test order email and note the storage address.
  2. Remove the file name from the address and open the bucket’s root address in a browser.
  3. The full list of invoice files appears, and each one downloads without a login.
GET / HTTP/1.1
Host: adminsoehne-invoices.s3.eu-central-1.amazonaws.com

HTTP/1.1 200
<ListBucketResult> <Key>2024/INV-100001.pdf</Key> …

Business impact

Every invoice ever issued, with names, addresses and purchases, is public. Automated scanners look for open buckets around the clock, so a copy may already exist elsewhere. Reportable under GDPR within 72 hours, fines possible.

Remediation

Turn on “Block public access” for the bucket and the whole account. Serve invoices through short-lived signed links created after the customer logs in. Check the bucket’s access logs to find out whether anyone has already downloaded the files.

OWASP Top 10 2021: A01 Broken Access Control · CWE-284 (Improper Access Control) · MITRE ATT&CK T1530 (Data from Cloud Storage)

Fixed price from

€3,300

4 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does a cloud penetration test cost?
Fixed prices start at €3,300 for one to three accounts or subscriptions. More accounts add effort. Microsoft 365 and Kubernetes can be included with no extra fee for the topic itself; if they need more test days, the quote shows them upfront. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.
Will the test disrupt our production workloads?
No. The configuration review uses read-only access. Active tests are agreed upfront, run within the providers' testing rules and never include load tests or destructive actions.
What do you need from us?
A read-only role in each account or subscription in scope, a list of what is in scope, and a contact for emergencies. We send you the exact permissions before the start.
Isn't the cloud provider responsible for security?
The provider secures the platform. Your identities, permissions, configuration and data are your responsibility. That is where most cloud findings come from.
How is this different from a cloud security tool?
Posture tools list settings that deviate from a baseline. A tester also checks which of them can be combined into a real path to your data, and which alerts are noise.

Related services

NIS2 & Compliance

Cloud pentest: your fixed price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call