AWS Penetration Test Cost (2026): $15K to $50K

AWS pentest pricing by scope

AWS pentest scope by service category

The customer side of the AWS shared responsibility model is what an AWS pentest covers. AWS itself is responsible for the underlying infrastructure; the customer is responsible for everything they configure on top. The scope categories below cover roughly 90% of AWS pentest engagements.

Why multi-account AWS pentests cost more

A multi-account AWS environment (the standard deployment pattern for any production-grade AWS workload) changes the pentest scope qualitatively, not just quantitatively. The tester needs to map cross-account trust relationships, review Service Control Policies at the AWS Organizations level, identify assume-role chains that span accounts, and verify that account boundaries actually enforce the authorisation model the architect intended.

A common cost-driving multi-account complexity is "cross-account assume-role for centralised tooling". Many organisations centralise tooling (security scanning, cost reporting, configuration management) in one account that has assume-role permissions into every workload account. The tooling account becomes a high-value target, and validating its blast radius takes meaningful testing time.

The other multi-account cost driver is reading SCPs accurately. SCPs are restrictive by nature, but their interaction with IAM policies is non-trivial, and a tester needs to reason carefully about what the effective permission set is for each principal in each account.

EKS and container scope addons

Adding EKS to an AWS pentest typically increases the engagement by $7,000-$15,000 because container security is a substantively different discipline from cloud-control-plane security. The EKS-side scope covers Pod Security Standards enforcement, RBAC review inside the cluster, IAM Roles for Service Accounts (IRSA) configuration, container image scanning gaps, runtime security if Falco or similar is deployed, network policy enforcement, and any in-cluster service mesh (Istio, Linkerd) authorisation model.

For organisations running Fargate (serverless containers), the addon cost is typically lower ($4,000-$8,000) because the underlying container runtime is AWS-managed, removing several attack categories from scope.

AWS-specific scoping pitfalls

Three AWS-specific scoping decisions consistently surprise first-time buyers.

1. Production vs sandbox testing. Most reputable firms refuse to pentest production environments without an explicit sign-off because the risk of unintentional impact (deleting production resources, triggering alarms, hitting rate limits) is real. Set up a near-production sandbox or accept the production-test risk explicitly.
2. Account inventory accuracy. Many organisations under-declare their AWS account count because shadow accounts (developer experimentation, acquired company environments) are forgotten. The tester typically asks for AWS Organizations exports during scoping; provide the full list to avoid mid-engagement scope expansion.
3. Application-layer inclusion. An AWS pentest that excludes the applications running on the AWS infrastructure misses many real-world attack paths. Bundle web app or API testing where it makes sense; the bundled price is usually 15-20% below separate engagements.