How is Cloud Web Application Penetration Test Different from Conventional testing

For a standard penetration test where the tester is given a user login and the public URL of the web app, it does not matter where/how that app is hosted. The actions required to mitigate/remediate any findings might be different for an app running on AWS, but the test process itself should be the same.

For assessing the security of your AWS account more generally, there are a number of tools available:

• AWS Trusted Advisor provides a number of security checks including for public Snapshots and S3 Objects, potential IAM misconfiguration, and unrestricted security group rules.
• The Security Pillar of the AWS Well-Architected Framework, which provides guidance and recommendations to design and operate secure AWS workloads. You can also self-assess your current workloads by conducting a Well-Architected Framework Review from the AWS console.
• Other Security, Identity and Compliance services that can help you address your data protection, logging, monitoring, and incident response needs on AWS.
• Third party tools, such as the ones you identified in your post.

For further assistance you might also consider engaging with a AWS Security Competency Partner - these partners are vetted by AWS and have a proven track-record of helping customers improve their cloud security posture.

As JamesB mentioned, from a pure "Web-application" penetration testing point of view, the cloud itself is irrelevant.

One of the questions a lot struggle with is the following: what do we call validating any misconfigurations in the Cloud as Penetration testing, or rather, Security auditing of/for/in the cloud? One could be part of the other, or not at all.

In any case, to suggest specific tools, could you provide more info:

1. Do you have access to the AWS accounts hosting the Web Application (such as ReadOnlyAccess)?
2. Is the Web application hosted purely on S3, or EC2, ECS, EKS, etc?
3. Or are you simply given a URL and a web-based user account and you are asked to perform a security pentest or audit purely from an attacker perspective on the internet?