← ReflexSec
Cloud
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Dangerous
aws iam attach-user-policy --user-name svc-deploy --policy-arn arn:aws:iam::aws:policy/AdministratorAccessIntermediate - Safe
terraform plan -out=tfplanExpert - Safe
az account show --query id -o tsvExpert - Dangerous
aws ec2 authorize-security-group-ingress --group-id sg-0a1b2c3d --protocol tcp --port 22 --cidr 0.0.0.0/0Expert - Dangerous
aws iam attach-role-policy --role-name build-runner --policy-arn arn:aws:iam::aws:policy/AdministratorAccessProAdvanced - Safe
aws iam put-role-policy --role-name build-runner --policy-name artifacts-write --policy-document file://./policy/artifacts-write.jsonProIntermediate - Dangerous
terraform apply -auto-approveProExpert - Safe
aws sts get-caller-identity --query Arn --output textProAdvanced - Dangerous
aws s3api put-bucket-policy --bucket app-assets-example --policy file://./infra/public-read.jsonProExpert - Safe
aws s3api list-buckets --output json | jq --argjson limit 50 '.Buckets | .[:$limit]'ProAdvanced - Safe
terraform plan -out=tfplan -var-file=prod.tfvarsProAdvanced - Dangerous
terraform apply -auto-approve -var-file=prod.tfvarsProIntermediate - Safe
aws configure listProIntermediate - Safe
aws s3 ls s3://app-assets-example/releases/ProIntermediate - Dangerous
aws s3 rm s3://example-backups --recursiveProIntermediate - Dangerous
aws cloudtrail stop-logging --name org-trailProIntermediate - Safe
aws lambda invoke --function-name api --payload file://payload.json out.jsonProIntermediate - Safe
aws logs tail /aws/lambda/api --since 30m --followProIntermediate - Safe
curl -s http://metadata.example.internal/latest/meta-data/instance-idProIntermediate - Safe
aws s3 rm s3://app-assets-example/tmp/build-2026-09-01.logProIntermediate - Safe
aws rds describe-db-instances --query 'DBInstances[].{Id:DBInstanceIdentifier,Public:PubliclyAccessible}'ProIntermediate - Dangerous
gsutil iam ch allUsers:objectViewer gs://app-assets-exampleProIntermediate - Dangerous
aws rds delete-db-instance --db-instance-identifier prod-db --skip-final-snapshotProIntermediate - Dangerous
aws s3 sync ./dist s3://app-assets-example --acl public-readProIntermediate - Dangerous
az storage account update --name appstore --allow-blob-public-access trueProIntermediate - Dangerous
aws s3api delete-public-access-block --bucket app-assets-exampleProIntermediate - Safe
aws s3api get-bucket-policy-status --bucket app-assets-example --query PolicyStatus.IsPublicProIntermediate - Safe
aws s3 presign s3://app-assets-example/report.pdf --expires-in 300ProIntermediate - Safe
aws cloudtrail get-trail-status --name org-trail --query IsLoggingProIntermediate - Dangerous
aws logs put-retention-policy --log-group-name /aws/lambda/api --retention-in-days 1ProAdvanced - Dangerous
aws ec2 modify-instance-metadata-options --instance-id i-0abc123def456789 --http-tokens optionalProAdvanced - Safe
aws ec2 describe-instance-attribute --instance-id i-0abc123def456789 --attribute userData --query 'UserData.Value' --output text | base64 -dProExpert - Safe
aws ssm start-session --target i-0abc123def456789ProAdvanced - Safe
aws ec2 modify-instance-metadata-options --instance-id i-0abc123def456789 --http-tokens required --http-put-response-hop-limit 1ProAdvanced - Safe
gcloud container clusters get-credentials prod-cluster --region us-central1ProAdvanced - Dangerous
aws kms schedule-key-deletion --key-id alias/app-data --pending-window-in-days 7ProExpert - Dangerous
aws lambda add-permission --function-name api --statement-id public --action lambda:InvokeFunction --principal '*'ProExpert - Dangerous
aws s3api put-bucket-versioning --bucket example-backups --versioning-configuration Status=SuspendedProExpert - Safe
aws s3api put-public-access-block --bucket app-assets-example --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=trueProNightmare - Safe
nohup aws s3 sync ./data s3://example-backups/data --storage-class GLACIER &ProNightmare - Safe
aws accessanalyzer list-analyzers --query 'analyzers[].{Name:name,Status:status}'ProExpert - Dangerous
aws guardduty create-filter --detector-id d-0abc123 --name noise --action ARCHIVE --finding-criteria file://./gd-filter.jsonProNightmare - Dangerous
aws cloudtrail update-trail --name org-trail --no-is-multi-region-trail --no-include-global-service-eventsProNightmare - Safe
terraform destroy -auto-approve -target=aws_instance.redirectorProNightmare - Dangerous
aws iam create-access-key --user-name backup-svc > ~/.hidden/keys.jsonProNightmare - Dangerous
aws ec2 stop-instances --instance-ids i-0abc123def456789ProIntermediate - Safe
aws ec2 create-snapshot --volume-id vol-0abc123 --description 'IR-2026-004 evidence'ProExpert - Dangerous
aws ec2 terminate-instances --instance-ids i-0abc123def456789ProExpert - Dangerous
az vm delete --name web01 --resource-group prod --yes --force-deletionProExpert - Dangerous
terraform apply -auto-approve -replace=aws_instance.web01ProNightmare - Dangerous
aws s3api delete-bucket --bucket example-archiveBeginner