Cloud IAM privilege escalation

When it applies

You have some cloud identity (leaked keys, an SSRF-obtained role — cloud-imds-ssrf, a compromised service account) and want to escalate to admin or reach more resources.

Why it works

IAM is complex and permissions are over-granted. A handful of seemingly-minor permissions form known escalation paths — creating a policy version, attaching a policy, passing a role, updating a function's code/role — that promote a low-priv identity to admin.

Method

1. Identify & enumerate: aws sts get-caller-identity; enumerate your effective permissions (enumerate-iam, pacu, or read attached policies). GCP: gcloud ... get-iam-policy; Azure: az role assignment list.
2. Find an escalation primitive (AWS examples):
   • iam:CreatePolicyVersion / SetDefaultPolicyVersion → grant yourself *.
   • iam:AttachUserPolicy / PutUserPolicy → attach AdministratorAccess.
   • iam:PassRole + lambda:CreateFunction/ec2:RunInstances/glue/cloudformation → run code as a privileged role.
   • iam:CreateAccessKey on another user; sts:AssumeRole on an over-trusting role. GCP: iam.serviceAccounts.actAs, setIamPolicy, editor→owner via deploymentmanager.
3. Execute the path (in scope), then confirm elevated access with a read-only admin call.
4. Automate discovery with pacu (AWS) escalation modules / ScoutSuite for the landscape.

Gotchas

• Enumerate permissions first — escalation depends entirely on which ones you hold.
• Prove escalation with a minimal, reversible action; don't create lasting admin backdoors on a live account (RoE).
• Temp creds expire — capture get-caller-identity before and after as proof.

Verify success

You gain permissions/resources beyond your starting identity (e.g. an admin-only call now succeeds, or you assume a higher-priv role), demonstrated with before/after identity.

References

Rhino Security "AWS IAM privilege escalation" methods; Pacu; GCP/Azure privesc guides; ScoutSuite.