We have a few web applications newly hosted on AWS. Before we run an automated pentest on the our Application URL using Netsparker, we had always e-mailed Amazon and requested authorization for the penetration testing. However, a question has popped up within our team whether the pentest authorization request is actually required or not when running a penetration test against an Application hosted in AWS? Some of them has the opinion that we need the authorization only when pentesting AWS services (like EC2, RDS, Aurora..etc) and not when we are pentesting an application hosted in AWS . This page that says that the authorization is required "for penetration testing to or originating from any AWS resources" is not very clear about this distinction.
From my experience as someone who has run automated pentest scans against web applications hosted in AWS - couple of times when I ran the scan without authorization, Netsparker stopped the scan (with a connection terminated message) after 10 to 15 minutes of scanning, but couple of times the scans did went through to completion after a few hours of scanning.
So the question is:
- Do we have to get the authorization from Amazon for scanning a web-application hosted on an EC2 instance or we have to get the authorization from Amazon ONLY when scanning the EC2 instance itself on an infrastructure level?
We have already e-mailed Amazon for an answer, but they seem to be taking a long time to reply. Just hoping if someone here would have an answer before Amazon gets back.