一键在 Manus 中运行任何 Skill

detecting-aws-iam-privilege-escalation

星标21

分支1

更新时间2026年7月3日 14:43

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

theheavenlyd3mon

theheavenlyd3mon/hermes-profiles

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Detecting AWS IAM Privilege Escalation

Overview

This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.

When to Use

When investigating security incidents that require detecting aws iam privilege escalation
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.8+ with boto3 library
AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
Optional: cloudsplaining Python package for HTML report generation

Steps

Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
Score and Prioritize Findings — Rank findings by severity based on escalation vector type
Generate Report — Produce structured JSON report with remediation guidance

Expected Output

JSON report of privilege escalation findings with severity scores
List of dangerous permission combinations per principal
Wildcard resource policy audit results
Remediation recommendations for each finding

同仓库更多 Skills

同仓库

auditing-aws-s3-bucket-permissions

theheavenlyd3mon/hermes-profiles

Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.

2026-07-0321

auditing-azure-active-directory-configuration

theheavenlyd3mon/hermes-profiles

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

2026-07-0321

auditing-cloud-with-cis-benchmarks

theheavenlyd3mon/hermes-profiles

This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.

2026-07-0321

auditing-gcp-iam-permissions

theheavenlyd3mon/hermes-profiles

Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

2026-07-0321

auditing-kubernetes-cluster-rbac

theheavenlyd3mon/hermes-profiles

Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.

2026-07-0321

auditing-terraform-infrastructure-for-security

theheavenlyd3mon/hermes-profiles

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

2026-07-0321

name	detecting-aws-iam-privilege-escalation
description	Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations
domain	cybersecurity
subdomain	cloud-security
tags	["aws","iam","privilege-escalation","cloudsplaining","boto3","policy-analysis","least-privilege"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Detecting AWS IAM Privilege Escalation

Overview

When to Use

When investigating security incidents that require detecting aws iam privilege escalation
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.8+ with boto3 library
AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
Optional: cloudsplaining Python package for HTML report generation

Steps

Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
Score and Prioritize Findings — Rank findings by severity based on escalation vector type
Generate Report — Produce structured JSON report with remediation guidance

Expected Output

JSON report of privilege escalation findings with severity scores
List of dangerous permission combinations per principal
Wildcard resource policy audit results
Remediation recommendations for each finding