Penetration Testing with Cloud Providers
AWS
Penetration Testing for UW Owned Resources: Allowed for a listed subset of AWS services
Penetration Testing from UW Owned Resources: Recommended, please complete simulated events form at least 48 hours prior to testing
Simulated Events Form:https://console.aws.amazon.com/support/contacts#/simulated-events
- Who completes the form? The primary penetration tester from Testing and Cyber Defense Team
- When do I need the form? When doing DDoS simulation, malware testing, red/blue/purple team testing, and/or phishing tests from or to AWS resources
- What can I test? Please review the AWS Penetration Testing Policy to confirm permitted testing resources
Network Limitations for Penetration Testing (Not to Exceed)
- Bit Volume: 1 Gbps (1 billion bits per second)
- Packet Volume: 1 Gpps (1 billion packets per second)
Azure
Penetration Testing Policy: https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
Penetration Testing Rules of Engagement: https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement?rtc=1
Penetration Testing for UW Owned Resources: Can only perform scanning for OWASP top 10, fuzzing or port scanning on endpoints
Penetration Testing from UW Owned Resources: Not recommended
GCP
Penetration Testing Policy: https://support.google.com/cloud/answer/6262505?hl=en#zippy=,do-i-need-to-notify-google-that-i-plan-to-do-a-penetration-test-on-my-project
Penetration Testing for UW Owned Resources: Allowed for resources within UW Projects
Penetration Testing from UW Owned Resources: Not recommended
GoDaddy
Penetration Testing Policy: https://support.google.com/cloud/answer/6262505?hl=en#zippy=,do-i-need-to-notify-google-that-i-plan-to-do-a-penetration-test-on-my-project
Penetration Testing for UW Owned Resources: Allowed for resources within UW Projects
Penetration Testing from UW Owned Resources: Not recommended
