The Terms and Conditions on Amazon's AWS prohibit activities called, "White cards" and "Red team and blue team testing". What do these terms mean?

  • 3
    Actually, the pentesting section defines the specific condition allowing you to perform security testing, it doesn't prohibit them.
    – Stephane
    Feb 16, 2016 at 14:38
  • 1
    when I google Red team testing, I find: csoonline.com/article/2122440/emergency-preparedness/… and tons of other sources, including wikipedia
    – schroeder
    Feb 16, 2016 at 16:14
  • 2
    Yes, as @Stephane says they are not prohibited, except against smaller instances. The terms state you need to get permission first, not that you cannot perform such tests. Feb 16, 2016 at 17:21

1 Answer 1


White card:

white card is a simulated event in an operational test. White cards are used when a system is too fragile or operationally critical for the adversarial team to pursue an exploitation, or when the adversarial team is unable to penetrate the system, but there is still a desire to evaluate the ability of the system to react to a penetration. White cards should be used only when necessary


Red team / blue team:

Red team-blue team exercises take their name from their military antecedents. The idea is simple: One group of security pros--a red team--attacks something, and an opposing group--the blue team--defends it. Originally, the exercises were used by the military to test force-readiness. They have also been used to test physical security of sensitive sites like nuclear facilities and the Department of Energy's National Laboratories and Technology Centers. In the '90s, experts began using red team-blue team exercises to test information security systems.


  • 1
    I am sorry, but I can't imagine what the first could be and why it would be something Amazon AWS explicitly forbids. Can you maybe give an example?
    – Philipp
    Feb 16, 2016 at 16:45
  • 3
    The first one is when you decide NOT to attack a specific component and will "behave as if" it was penetrated. For instance, you might have to pentest a network that has a firewall used in production. You might not have the autorisation to exploit a buffer overflow in said firewall to gain access because that would impact production. In this case, you might decide to ask the admin to grant you access ("carte blanche") through that firewall to continue your test.
    – Stephane
    Feb 16, 2016 at 17:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .