1

We have a few web applications newly hosted on AWS. Before we run an automated pentest on the our Application URL using Netsparker, we had always e-mailed Amazon and requested authorization for the penetration testing. However, a question has popped up within our team whether the pentest authorization request is actually required or not when running a penetration test against an Application hosted in AWS? Some of them has the opinion that we need the authorization only when pentesting AWS services (like EC2, RDS, Aurora..etc) and not when we are pentesting an application hosted in AWS . This page that says that the authorization is required "for penetration testing to or originating from any AWS resources" is not very clear about this distinction.

From my experience as someone who has run automated pentest scans against web applications hosted in AWS - couple of times when I ran the scan without authorization, Netsparker stopped the scan (with a connection terminated message) after 10 to 15 minutes of scanning, but couple of times the scans did went through to completion after a few hours of scanning.

So the question is:

  • Do we have to get the authorization from Amazon for scanning a web-application hosted on an EC2 instance or we have to get the authorization from Amazon ONLY when scanning the EC2 instance itself on an infrastructure level?

We have already e-mailed Amazon for an answer, but they seem to be taking a long time to reply. Just hoping if someone here would have an answer before Amazon gets back.

Improve this question
2

2 Answers 2

Reset to default
4

Yes, you need authorisation for a penetration test of any service running on the AWS infrastructure, whether or not it’s a service directly managed by Amazon themselves. Source: personal experience and discussion with my AWS account manager. Remember, your pen test will be testing things like AWS security groups and network ACLs as well as your own service.

Improve this answer
1
  • Thank you. Amazon got back to us on our inquiry e-mail and they have confirmed this too, that we need to get the authorization even if it is our own web-application.
    – Sreeraj
    Commented Feb 6, 2019 at 4:46
3

It seems AWS is changing the policy and becoming more flexible. There is no more form submission / authorization needed from AWS customer service. However, there are a few rules you need to abide by or risk being contacted by AWS security.

https://aws.amazon.com/security/penetration-testing/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .