detecting-aws-iam-privilege-escalation

name	detecting-aws-iam-privilege-escalation
description	Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations
domain	cybersecurity
subdomain	cloud-security
tags	["aws","iam","privilege-escalation","cloudsplaining","boto3","policy-analysis","least-privilege"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Detecting AWS IAM Privilege Escalation

Overview

This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.

When to Use

• When investigating security incidents that require detecting aws iam privilege escalation
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Detection Gaps & Validation

• GetAccountAuthorizationDetails doesn't show the whole picture: it returns attached/inline/group policies but not permission boundaries, SCPs, session policies, or resource-based policies. A flagged path may actually be blocked by a boundary/SCP (false positive), or a real escalation may be enabled by a resource policy (e.g., a role's trust policy or an S3/KMS policy) you never parsed (false negative). Reconcile against the boundary and trust policy before reporting.
• Non-default policy versions and inheritance: check the policy's default version (attackers stage admin in a non-default version via iam:CreatePolicyVersion/SetDefaultPolicyVersion), and expand group-inherited permissions. NotAction/Deny statements and Condition keys (aws:PrincipalTag, MFA) are ignored by naive substring matching.
• Privesc combos beyond the well-known ones: iam:PutUserPolicy, iam:AttachGroupPolicy, iam:UpdateAssumeRolePolicy, and iam:PassRole paired with glue/cloudformation/datapipeline/sagemaker/codebuild create functions, plus ssm:SendCommand on instances bearing admin instance profiles.
• Validate the path is real: confirm with aws iam simulate-principal-policy --policy-source-arn … --action-names iam:AttachUserPolicy … (it honors boundaries/SCPs), or actually exercise the chain in an isolated test account — don't report an escalation that a boundary silently denies.