AWS IAM: the privilege escalation paths

February 13, 2025 · 1 min read · #cloud #aws #iam

In AWS privileges are IAM policies. Escalation rarely exploits a bug: it exploits mis-assigned permissions that let you grant yourself more.

The classic ladders

iam:CreatePolicyVersion: create a new version of a policy you control, with Action:*. iam:PassRole + lambda:CreateFunction: create a Lambda that assumes a privileged role and run its code. iam:AttachUserPolicy: attach AdministratorAccess to yourself.

aws iam create-policy-version --policy-arn ... \
  --policy-document file://admin.json --set-as-default

Tools like Pacu or enumerate-iam map these paths automatically.

Defence

Real least privilege, no wildcards in Action/Resource, iam:PassRole restricted to specific roles, permission boundaries, and IAM Access Analyzer to find excessive access. Periodic policy audits with simulators.

« back to home