My understanding: There's three parties: 1. Cloud service provider, 2. Client, 3. Tester Client pays Tester to find vulns in Client's setup, including third p

My understanding: There's three parties: 1. Cloud service provider, 2. Client, 3. Tester Client pays Tester to find vulns in Client's setup, including third party tools used by Client. Client notifies Cloud that there will be testing, and presumably the ToS allow such pentesting. In the process Tester discovers vulns in Cloud. The AWS rules are complicated https://aws.amazon.com/security/penetration-testing/ https://aws.amazon.com/security/penetration-testing/, for Google Cloud, you don't need to notify https://support.google.com/cloud/answer/6262505?hl=en#zippy=%2Cdo-i-need-to-notify-google-that-i-plan-to-do-a-penetration-test-on-my-project https://support.google.com/cloud/answer/6262505?hl=en#zippy=..., Microsoft used to require notification but no longer does https://docs.microsoft.com/en-us/azure/security/fundamentals/pen-testing https://docs.microsoft.com/en-us/azure/security/fundamentals... and seems to allow pentesting their services as long as you don't DoS them or exploit found vulnerabilities beyond a proof of concept.