Direct answer
A cloud penetration test needs authorization from the customer and compliance with the applicable provider's current testing policy. Permission to assess one resource does not automatically extend to shared services or other tenants.
Identify ownership and service boundaries
List the provider, account, region, resource owner, services and testing sources. Distinguish customer-managed workloads from provider-operated services and third-party systems. Ask the owner to authorize each environment and relevant integration.
Reference: AWS penetration testing policy.
Read current provider policy
Check the provider's security testing terms for the exact services and techniques. AWS, for example, publishes penetration testing guidance and restrictions. Rules and permitted services can change, so consult the current provider page rather than relying on an old test plan.
- Record exclusions and any required provider notifications.
- Agree request rates and stop conditions.
- Name monitoring and incident-response contacts.
Agree rules of engagement
Specify whether testing includes authenticated access, configuration review, exploitation or only safe discovery. Define data-handling requirements, prohibited actions and steps to take if another tenant's information or an unrelated compromise is encountered.
Maintain coverage records
Track tested resources and starting locations, inaccessible services and provider-imposed exclusions. Reconfirm authorization when scope changes, then provide findings and retest evidence through approved channels. Record the specific service policy and the date it was checked so a later assessor can revalidate it.
Assessment limits
Provider terms differ by service and may change. This checklist is not provider approval or legal advice; confirm the current terms and customer authorization for the actual engagement.
Frequently asked questions
Is owning a cloud account enough to test a provider's infrastructure?
No. Authorization applies to the owner's scope and remains subject to provider rules and third-party boundaries.
Does a prior test approval cover new resources?
Not automatically. Reconfirm the current scope, owner and provider rules when targets or techniques change.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.