hunting-iam-privilege-escalation-paths

name	hunting-iam-privilege-escalation-paths
description	Hunt privilege-escalation paths in cloud identity and access management: a low-privileged principal that chains role assumptions, policy rewrites, role-passing, and over-broad trust relationships to reach an administrative or data-access principal. Covers the identity-to-permission-to-resource graph, the known escalation primitives (passing a more privileged role to a service, rewriting a policy to a permissive version, assuming a role whose trust condition is too loose), and the boundary controls that should stop the chain. Use when reviewing cloud IAM, role and policy configuration, or an identity graph. A reachable path from an untrusted principal to admin is the finding.
license	MIT

Hunting IAM privilege-escalation paths: a reachable chain to admin is the bug

Cloud access is a graph. Principals hold policies, policies grant permissions, and some of those permissions let a principal change the graph itself: pass a role, rewrite a policy, assume another identity. Privilege escalation is a path through that graph from where an attacker starts to a principal that can read the data or run the workloads that matter. No single permission looks alarming. The bug is the reachable chain, and you only see it when you follow the edges.

When to use

• You are reviewing cloud IAM: roles, policies, groups, and trust relationships.
• A principal is meant to be low-privileged and you want to prove it cannot reach admin.
• You have the policy documents and want to know what they compose into, not just what each says.

Scope check

Audit identity configuration in accounts you own or are authorized to test, with credentials provisioned for the review. If you can't name the authorization, stop.

The loop

1. Build the identity graph. Inventory every principal, the policies attached to it, the permissions those policies grant, and the resources they touch. Represent it as edges: principal grants permission on resource. The whole method is reachability over this graph, so the graph is the first artifact.