Quick answer

In the “Cloud” section, LinPEAS detects whether you are on a cloud instance and enumerates instance metadata and credentials for AWS (EC2/ECS/Lambda/CodeBuild), GCP, Azure (VM/App/Automation), DigitalOcean, Alibaba, IBM and Tencent.

What it checks#

  • Cloud detection via provider metadata endpoints.
  • Instance identity and, where reachable, temporary credentials / IAM role data.
  • Provider-specific service metadata (e.g. ECS task role, Azure managed identity).
High-impact checks

Cloud metadata enumeration reaches provider metadata endpoints (e.g. 169.254.169.254). Retrieving cloud credentials during an engagement can have significant blast radius — only do this within an explicitly authorised scope. See our security policy.

Verify it yourself#

Illustrative metadata query
# AWS example (authorised testing only)
curl -s http://169.254.169.254/latest/meta-data/ 2>/dev/null | head

Sources & references

  1. linPEAS README
  2. PEASS-ng release — reviewed 20260908-dffb9496
  3. HackTricks: Linux privilege escalation