Skip to content
Pwnversity

IAM Abuse and Privilege Escalation

In the cloud, IAM (Identity and Access Management) is the system that decides who can do what. It’s, in effect, the new perimeter: compromising an identity with the right permissions equals being an administrator. Cloud privilege escalation rarely exploits a bug: it chains legitimate, misassigned permissions to go from a limited identity to full control of the account. It’s the heart of cloud pentesting.

Threat model

Section titled “Threat model”

IAM policies are complex and it’s easy to over-grant. Certain permissions, even if they seem harmless, let you grant yourself more privileges: create users, attach policies, assume roles, modify functions that run with privileged roles. An attacker controlling an identity looks for those “escalation permissions” and chains them to admin.

Enumerate what you can (first)

Section titled “Enumerate what you can (first)”
# AWS: who am I and what permissions do I have?
aws sts get-caller-identity
aws iam get-account-authorization-details     # if permitted
enumerate-iam --access-key ... --secret-key ...   # brute-force permissions
# escalation-mapping tools
pacu           # AWS exploitation framework (privesc modules)
cloudsplaining / PMapper   # analyze policies and escalation paths

AWS escalation permissions (the classics)

Section titled “AWS escalation permissions (the classics)”

Rhino Security cataloged ~20 paths. The most common:

iam:CreateAccessKey            -> create a key for ANOTHER user (admin)
iam:AttachUserPolicy / PutUserPolicy  -> attach yourself AdministratorAccess
iam:CreatePolicyVersion        -> rewrite a policy you're subject to
iam:PassRole + ec2:RunInstances     -> launch EC2 with an admin role and use its IMDS
iam:PassRole + lambda:CreateFunction -> function running as an admin role
sts:AssumeRole                 -> assume a more privileged role (if trust allows)
iam:UpdateAssumeRolePolicy     -> modify who can assume a role

Direct example: with iam:AttachUserPolicy on yourself, you attach AdministratorAccess → admin.

aws iam attach-user-policy --user-name me --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

PassRole: the most dangerous permission

Section titled “PassRole: the most dangerous permission”

iam:PassRole lets you “pass” a role to a service (EC2, Lambda, etc.). If you can pass an admin role to a function/instance you control, you run code as that role:

# pass an admin role to a Lambda you create -> code as admin
# or to an EC2 -> steal its credentials via IMDS (see cloud-metadata)

Azure and GCP (equivalents)

Section titled “Azure and GCP (equivalents)”
# Azure
# roles with Microsoft.Authorization/roleAssignments/write -> assign yourself Owner
# abuse of Managed Identities, Automation Accounts, app consent
# tools: AzureHound, ROADtools, MicroBurst
# GCP
# iam.serviceAccounts.getAccessToken / actAs -> impersonate a privileged SA
# setIamPolicy -> grant yourself roles; abuse of Cloud Functions/Compute with an admin SA
# tools: GCPBucketBrute, gcp_scanner, Hayat

Methodology

Section titled “Methodology”
1. Enumerate identity and permissions (sts/az/gcloud + enumerate-iam)
2. Look for escalation permissions (pacu/PMapper/cloudsplaining)
3. Identify the shortest path to admin
4. Execute the escalation (attach policy, pass role, assume role, impersonate)
5. Confirm privileges and document impact

For the defense

Section titled “For the defense”
  • Real least privilege: no *:*, review dangerous permissions (iam:*, broad PassRole/AssumeRole).
  • Access analyzers: AWS IAM Access Analyzer, cloudsplaining, PMapper — detect escalation paths before the attacker.
  • Separate service roles and scope trust policies (who can AssumeRole/actAs).
  • Permission boundaries and SCPs (AWS) / conditions (Azure/GCP) to cap the maximum reach.
  • Logging (CloudTrail) and alerts on sensitive IAM actions (AttachPolicy, CreateAccessKey, PassRole).

Testing checklist

Section titled “Testing checklist”
  • Enumerate identity and permissions (sts/az/gcloud + enumerate-iam)
  • Look for escalation permissions (pacu/PMapper/cloudsplaining)
  • AttachUserPolicy/PutUserPolicy → AdministratorAccess
  • PassRole + RunInstances/CreateFunction → admin role
  • AssumeRole / UpdateAssumeRolePolicy
  • Azure: roleAssignments/write → Owner; Managed Identities
  • GCP: actAs/getAccessToken → impersonate an admin SA
  • Confirm privileges and map the path

References

Section titled “References”