By now AWS, Azure and GCP have dropped the requirement to inform them about pentests on resources in their infrastructure. Each provider has defined a set of rules in regards to which services as well as which actions are allowed without telling them. In general, it can be summarized that it is similar to the “shared responsibility model”. This means pentests on resources you are managing yourself are allowed. On the other hand, no provider allows testing Distributed Denial of Service (DDoS) attacks or attacking other customers. SEC Consult can support you to understand the specific terms and conditions as to whether it is necessary to inform the Cloud provider in your specific case.