| name | cloud-iam-privesc |
| description | Escalate privileges in cloud IAM (AWS/GCP/Azure) from a low-priv set of credentials. Load when you hold cloud creds/keys/a role and want higher privilege or new resources. Signals: leaked AWS keys, an assumed role, a service-account token, "escalate in AWS/GCP/Azure", enumerated permissions.
|
| domain | cloud |
| type | technique |
| stability | learning |
| modes | ["pentest","bugbounty"] |
| severity | critical |
| owasp | ["A01:2021-Broken-Access-Control"] |
| cwe | ["CWE-269"] |
| mitre | ["T1078.004","T1548"] |
| tools | ["awscli","pacu","scoutsuite","enumerate-iam"] |
| schema_version | 1 |
Cloud IAM privilege escalation
When it applies
You have some cloud identity (leaked keys, an SSRF-obtained role — cloud-imds-ssrf, a
compromised service account) and want to escalate to admin or reach more resources.
Why it works
IAM is complex and permissions are over-granted. A handful of seemingly-minor permissions form
known escalation paths — creating a policy version, attaching a policy, passing a role, updating a
function's code/role — that promote a low-priv identity to admin.
Method
- Identify & enumerate:
aws sts get-caller-identity; enumerate your effective permissions
(enumerate-iam, pacu, or read attached policies). GCP: gcloud ... get-iam-policy; Azure: az role assignment list.
- Find an escalation primitive (AWS examples):
iam:CreatePolicyVersion / SetDefaultPolicyVersion → grant yourself *.iam:AttachUserPolicy / PutUserPolicy → attach AdministratorAccess.iam:PassRole + lambda:CreateFunction/ec2:RunInstances/glue/cloudformation → run code as a privileged role.iam:CreateAccessKey on another user; sts:AssumeRole on an over-trusting role.
GCP: iam.serviceAccounts.actAs, setIamPolicy, editor→owner via deploymentmanager.
- Execute the path (in scope), then confirm elevated access with a read-only admin call.
- Automate discovery with
pacu (AWS) escalation modules / ScoutSuite for the landscape.
Gotchas
- Enumerate permissions first — escalation depends entirely on which ones you hold.
- Prove escalation with a minimal, reversible action; don't create lasting admin backdoors on a live account (RoE).
- Temp creds expire — capture
get-caller-identity before and after as proof.
Verify success
You gain permissions/resources beyond your starting identity (e.g. an admin-only call now
succeeds, or you assume a higher-priv role), demonstrated with before/after identity.
References
Rhino Security "AWS IAM privilege escalation" methods; Pacu; GCP/Azure privesc guides; ScoutSuite.
