5 ms·

Was curious the other day and couldn't find a real answer... does AWS allow portscanning from their infrastructure? All I could find was statements from them t

Was curious the other day and couldn't find a real answer... does AWS allow portscanning from their infrastructure? All I could find was statements from them that they do not allow port scanning OF their infrastructure.

Cantinflas 5y ago
They don't, I got a company acc banned scanning my own local infra from an aws instance
- deleted 5y ago
  [deleted]
- bowmessage 5y ago
  oof, how was that ultimately resolved? Hopefully a warning from support and a re-enabled account?
  - Cantinflas 5y ago
    Nope! Afaik they did not get the account re-enabled, at least for the next few months!
- slenk 5y ago
  You used to be able to let them know you were going to do certain kinds of pen-tests, unless port scanning is just one of those things never allowed
  - nkellenicki 5y ago
    You still can, but that's for pentests _targetting_ AWS hosted infrastructure. They've always frowned upon using AWS to target _other_ services, however.
samstave 5y ago
Sort-of. You can port scan your own infra/vpcs etc -- but YOU MUST tell them you are doing so and why you are doing it, else they will block it. again, as with anything AWS (and other providers) have a good rapport with your rep, and SEs in AWS and you have a lot more freedom than you expect just from boilerplate ULA TOS stuff. You may not scan anything other than your own infra. And you can get your external monitors whitelisted as well... Just talk to your rep.
mindcrime 5y ago
And if Amazon doesn't, are there any hosting providers that do allow port-scanning from their infrastructure? I'm assuming the big providers like AWS, Google and Azure all have these limits in place, but I wonder if you can do it from some of the smaller providers? Even if means going down to some fly-by-night outfit in Belize or something...
- throwaway39489 5y ago
  Smaller ones allow yes, they only frown when scanning ports relating to infrastructure stuff
helge9210 5y ago
Practically, no. Unsure about actual implementation, but looks like packets disappear right after leaving the interface.
dadrian 5y ago
If you bring your own IPs they don't care. However, the bandwidth fees are egregious.

Cantinflas 5y ago

They don't, I got a company acc banned scanning my own local infra from an aws instance

deleted 5y ago
[deleted]
bowmessage 5y ago
oof, how was that ultimately resolved? Hopefully a warning from support and a re-enabled account?
- Cantinflas 5y ago
  Nope! Afaik they did not get the account re-enabled, at least for the next few months!
slenk 5y ago
You used to be able to let them know you were going to do certain kinds of pen-tests, unless port scanning is just one of those things never allowed
- nkellenicki 5y ago
  You still can, but that's for pentests _targetting_ AWS hosted infrastructure. They've always frowned upon using AWS to target _other_ services, however.

samstave 5y ago

Sort-of. You can port scan your own infra/vpcs etc -- but YOU MUST tell them you are doing so and why you are doing it, else they will block it. again, as with anything AWS (and other providers) have a good rapport with your rep, and SEs in AWS and you have a lot more freedom than you expect just from boilerplate ULA TOS stuff. You may not scan anything other than your own infra. And you can get your external monitors whitelisted as well... Just talk to your rep.

mindcrime 5y ago

And if Amazon doesn't, are there any hosting providers that do allow port-scanning from their infrastructure? I'm assuming the big providers like AWS, Google and Azure all have these limits in place, but I wonder if you can do it from some of the smaller providers? Even if means going down to some fly-by-night outfit in Belize or something...

throwaway39489 5y ago
Smaller ones allow yes, they only frown when scanning ports relating to infrastructure stuff

helge9210 5y ago

Practically, no. Unsure about actual implementation, but looks like packets disappear right after leaving the interface.

dadrian 5y ago

If you bring your own IPs they don't care. However, the bandwidth fees are egregious.