# Cloud Apocalypse — AWS Audit (CTF challenge)

> ANALYSIS CHALLENGE (no live AWS — real cloud exploitation can't run in the sandbox). You're handed AWS evidence from a breach: a public S3 bucket policy, an over-broad IAM policy, and an exposed EC2…

Canonical: https://codelivly.com/ctf/challenges/cloud-apocalypse-aws-audit

| | |
|---|---|
| Category | Cloud Security |
| Difficulty | Hard |
| Points | 900 |
| Estimated time | 45 min |
| Type | Live instance |
| Solves | 16 |
| Author | Codelivly |

ANALYSIS CHALLENGE (no live AWS — real cloud exploitation can't run in the sandbox). You're handed AWS evidence from a breach: a public S3 bucket policy, an over-broad IAM policy, and an exposed EC2 instance-metadata (IMDSv1) dump. Trace the misconfiguration chain and recover the bootstrap secret the attacker obtained from the leaked user-data. Your own isolated instance; the token is unique to you.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)