AWS IAM Privilege Escalation: Real Attack Paths and How to Find Them

In AWS, identity is the perimeter and IAM is where attackers escalate. A low-privilege key plus one misconfigured permission is often enough to reach admin. These are the privesc paths a cloud pentester checks first.

Classic privesc paths

• iam:CreatePolicyVersion — rewrite an existing policy you are attached to, granting yourself more.
• iam:PassRole + service trust — pass a high-privilege role to a service you can launch (EC2, Lambda, Glue) and inherit it.
• iam:AttachUserPolicy / PutUserPolicy — attach AdministratorAccess to yourself.
• lambda:CreateFunction + iam:PassRole — run code as a privileged role.
• sts:AssumeRole on an over-trusting role.

Finding them

Start by enumerating what your identity can do, then look for the dangerous combos:

# Who am I and what is attached?
aws sts get-caller-identity
aws iam list-attached-user-policies --user-name YOU
aws iam get-account-authorization-details > iam.json   # full graph for offline analysis

Tools like Pacu (the AWS exploitation framework) and PMapper automate the privesc-path search across the IAM graph — the same data get-account-authorization-details dumps.

Closing the paths

1. Remove iam:* and PassRole from anything that does not strictly need it; scope PassRole to specific roles.
2. Use permission boundaries and SCPs to cap blast radius.
3. Prefer short-lived role credentials over long-lived user keys.
4. Run IAM Access Analyzer and review unused permissions regularly.

RingSafe maps your real IAM privesc paths in a cloud pentest. See cloud security services. Test only accounts you own or are authorised to assess.