Penetration Testing with Cloud Providers

This document provides the general guideline from cloud providers on what is allowed from cloud provider when performing penetration testing from and against the cloud provider

AWS

Penetration Testing Policy: https://aws.amazon.com/security/penetration-testing/

Penetration Testing for UW Owned Resources:
Allowed for a listed subset of AWS services
Penetration Testing from UW Owned Resources: Recommended, please complete simulated events form at least 48 hours prior to testing

Simulated Events Form:https://console.aws.amazon.com/support/contacts#/simulated-events
-
Who completes the form? The primary penetration tester from Testing and Cyber Defense Team
- When do I need the form? When doing DDoS simulation, malware testing, red/blue/purple team testing, and/or phishing tests from or to AWS resources
- What can I test? Please review the AWS Penetration Testing Policy to confirm permitted testing resources

Network Limitations for Penetration Testing (Not to Exceed)
- Bit Volume:
1 Gbps (1 billion bits per second)
- Packet Volume: 1 Gpps (1 billion packets per second)

 

Azure

Penetration Testing Policy: https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
Penetration Testing Rules of Engagement: https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement?rtc=1

Penetration Testing for UW Owned Resources: 
Can only perform scanning for OWASP top 10, fuzzing or port scanning on endpoints
Penetration Testing from UW Owned Resources: Not recommended

 

GCP

Penetration Testing Policy: https://support.google.com/cloud/answer/6262505?hl=en#zippy=,do-i-need-to-notify-google-that-i-plan-to-do-a-penetration-test-on-my-project

Penetration Testing for UW Owned Resources:
Allowed for resources within UW Projects
Penetration Testing from UW Owned Resources: Not recommended

 

GoDaddy

Penetration Testing Policy: https://support.google.com/cloud/answer/6262505?hl=en#zippy=,do-i-need-to-notify-google-that-i-plan-to-do-a-penetration-test-on-my-project

Penetration Testing for UW Owned Resources:
Allowed for resources within UW Projects
Penetration Testing from UW Owned Resources: Not recommended

 



Keywords:
pen test penetration testing tool cloud aws gcp azure ddos network load limit restriction load 
Doc ID:
137709
Owned by:
TCD K. in Cybersecurity Testing and Cyber Defense
Created:
2024-06-04
Updated:
2025-11-04
Sites:
Cybersecurity Operations Center, Cybersecurity Testing and Cyber Defense, Cybersecurity Vulnerablity Management, Office of Cybersecurity