ワンクリックでManusで任意のスキルを実行

detecting-aws-iam-privilege-escalation

スター21

フォーク1

更新日2026年7月3日 14:43

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

theheavenlyd3mon

theheavenlyd3mon/hermes-profiles

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

Detecting AWS IAM Privilege Escalation

Overview

This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.

When to Use

When investigating security incidents that require detecting aws iam privilege escalation
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.8+ with boto3 library
AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
Optional: cloudsplaining Python package for HTML report generation

Steps

Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
Score and Prioritize Findings — Rank findings by severity based on escalation vector type
Generate Report — Produce structured JSON report with remediation guidance

Expected Output

JSON report of privilege escalation findings with severity scores
List of dangerous permission combinations per principal
Wildcard resource policy audit results
Remediation recommendations for each finding

このリポジトリの他の Skills

同じリポジトリ

auditing-aws-s3-bucket-permissions

theheavenlyd3mon/hermes-profiles

Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.

2026-07-0321

auditing-azure-active-directory-configuration

theheavenlyd3mon/hermes-profiles

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

2026-07-0321

auditing-cloud-with-cis-benchmarks

theheavenlyd3mon/hermes-profiles

This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.

2026-07-0321

auditing-gcp-iam-permissions

theheavenlyd3mon/hermes-profiles

Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

2026-07-0321

auditing-kubernetes-cluster-rbac

theheavenlyd3mon/hermes-profiles

Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.

2026-07-0321

auditing-terraform-infrastructure-for-security

theheavenlyd3mon/hermes-profiles

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

2026-07-0321

name	detecting-aws-iam-privilege-escalation
description	Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations
domain	cybersecurity
subdomain	cloud-security
tags	["aws","iam","privilege-escalation","cloudsplaining","boto3","policy-analysis","least-privilege"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Detecting AWS IAM Privilege Escalation

Overview

When to Use

When investigating security incidents that require detecting aws iam privilege escalation
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.8+ with boto3 library
AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
Optional: cloudsplaining Python package for HTML report generation

Steps

Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
Score and Prioritize Findings — Rank findings by severity based on escalation vector type
Generate Report — Produce structured JSON report with remediation guidance

Expected Output

JSON report of privilege escalation findings with severity scores
List of dangerous permission combinations per principal
Wildcard resource policy audit results
Remediation recommendations for each finding