Attack Paths Into VMs in the Cloud

This report surveys common attack paths for cloud VM services across AWS, Azure, and GCP—such as vulnerability exploitation, startup script manipulation, SSH key insertion, direct code execution via management agents, session-based access (e.g., AWS SSM), and serial console access—and explains required preconditions, key permissions, and mitigations for each. It stresses that these are legitimate platform features that can be abused if IAM, configuration, and operational controls are weak, and provides concrete guidance to restrict risky permissions, harden agents and metadata usage, and disable unneeded access mechanisms to reduce exposure.