TagNabIt – AWS Cloud Resource Enumeration via Metadata Tags

TagNabIt is an offensive security toolkit described as a way to enumerate AWS cloud resources through metadata tags. Built in Python, it can be installed via a virtual environment and a requirements file, and it does not bypass authentication, instead leveraging valid sessions to reveal resources.

Its key capabilities include enumerating resources using tag:GetResources, bruteforcing IAM resources with tag-related calls, bruteforcing other resources with *:ListTagsForResource or *:ListTagsForResources, and searching CloudTrail Logs for tag-based enumeration activity. The article notes that operators can target specific tag values such as env=prod or owner=finance to locate critical systems more efficiently than broad service scanning.

In an attack scenario described for a red team engagement, an operator authenticates with low-privilege credentials and runs TagNabIt to list all tags, then filters for a tag like db-prod to quickly identify production database resources. The piece emphasises metadata can be as sensitive as credentials, highlighting the need for governance around tag usage in cloud environments.