Cloud Misconfig

Leaked AWS keys + missing IAM check = full account take.

When to invoke

Trigger phrases:

• "S3 bucket"
• "exposed cloud"
• "AWS key found"
• "Firebase config"
• "Kubernetes exposed"

In-scope check FIRST

Cloud assets belong to the target — confirm scope:

• *.s3.amazonaws.com — usually OOS unless explicitly in-scope OR you confirm bucket ownership via DNS/branding
• Subdomains pointing to cloud services — see [[subdomain-takeover]]
• Leaked credentials in code/apps belonging to target — usually in-scope as info disclosure