Developer Self-Attacks AWS API to Expose Cloud Security Gaps, Documents Every Step

A developer built and deliberately attacked two versions of a serverless Todo API on AWS to demonstrate real-world cloud security vulnerabilities. The experiment was conducted in compliance with AWS's penetration testing policy, which allows users to test infrastructure they own without prior authorization. One API version had no security controls, while the other was hardened as it would be for a production client, with both sharing the same basic architecture of API Gateway, Lambda, and DynamoDB. The first attack demonstrated enumeration, where an unauthenticated request to the vulnerable API returned every record in the database due to an unfiltered table scan and missing authentication. The developer published all code, Terraform files, and attack scripts on GitHub to help others understand that cloud security depends on what users build on their side of AWS's Shared Responsibility Model.