Lab 04 — Cloud Identity Assessment

Lab Information

Item	Details
Lab ID	CPS-LAB-004
Difficulty	Intermediate
Duration	2–3 Hours
Cloud Provider	AWS
Tools Required	AWS CLI, PMapper (Optional), IAM Access Analyzer, jq, ScoutSuite
Estimated Cost	Free Tier Eligible

---

Lab Overview

Cloud Identity is the number one attack target in modern cloud environments.

Unlike traditional infrastructure attacks that often target operating systems or applications, cloud attackers primarily focus on identities and permissions.

In this lab, you will perform a professional IAM security assessment similar to those conducted by enterprise cloud penetration testers.

You will enumerate identities, analyse IAM policies, identify privilege escalation paths and document business risks.

---

Learning Objectives

After completing this lab, you will be able to:

• Enumerate IAM identities.
• Review IAM policies.
• Assess IAM Roles.
• Identify excessive permissions.
• Review trust relationships.
• Discover privilege escalation opportunities.
• Analyse IAM attack paths.
• Produce an enterprise IAM assessment report.

---

Enterprise Scenario

CloudNova Technologies has been engaged to assess the AWS Identity architecture of FinSecure Bank.

The customer wants to know:

• Who has administrator access?
• Which users have excessive permissions?
• Can developers escalate privileges?
• Are inactive accounts still active?
• Which identities present the greatest business risk?

You have read-only assessment access.

---

Lab Architecture

                  AWS Account

                      │

        ┌─────────────┼─────────────┐
        │             │             │

     IAM Users     IAM Groups    IAM Roles

        │             │             │

    IAM Policies  Trust Policies  EC2 Roles

                      │

              AWS Resources

         EC2 • Lambda • S3 • EKS

---

Lab Prerequisites

Complete:

• Lab 01 — Build Your Cloud Pentesting Lab
• Lab 02 — Cloud Reconnaissance
• Lab 03 — Cloud Enumeration

Verify authentication:

aws sts get-caller-identity

---

Mission 1 — Verify AWS Authentication

Run:

aws sts get-caller-identity

Confirm:

• AWS Account ID
• IAM Identity
• ARN

---

Mission 2 — Enumerate IAM Users

List all IAM users.

aws iam list-users

Document:

• User Name
• Creation Date
• Password Enabled
• Path

Questions:

• Which accounts appear unused?
• Which accounts may be privileged?

---

Mission 3 — Enumerate IAM Groups

Run:

aws iam list-groups

Review:

• Administrators
• Developers
• DevOps
• Security
• ReadOnly

Determine which users belong to each group.

aws iam get-group \
--group-name Administrators

---

Mission 4 — Enumerate IAM Roles

Run:

aws iam list-roles

Review:

• Role Name
• Trusted Entity
• Description
• Last Used

Focus on:

• EC2 Roles
• Lambda Roles
• EKS Roles
• Cross-Account Roles

---

Mission 5 — Review IAM Policies

List local policies.

aws iam list-policies \
--scope Local

Review AWS managed policies.

aws iam list-policies \
--scope AWS

Identify policies such as:

• AdministratorAccess
• PowerUserAccess
• IAMFullAccess
• SecurityAudit

---

Mission 6 — Review Attached Policies

Identify policies attached to users.

aws iam list-attached-user-policies \
--user-name USERNAME

Review attached role policies.

aws iam list-attached-role-policies \
--role-name ROLE_NAME

Document all high-privilege identities.

---

Mission 7 — Review Trust Relationships

Retrieve trust policy.

aws iam get-role \
--role-name ROLE_NAME

Review:

• Principal
• Action
• Conditions

Look for:

• Cross-account trust
• Wildcards
• Unrestricted principals

---

Mission 8 — Review IAM Policy Permissions

Retrieve policy version.

aws iam get-policy-version \
--policy-arn POLICY_ARN \
--version-id VERSION

Identify:

• Wildcards
• Administrative actions
• Resource “*”
• iam:PassRole
• sts:AssumeRole

---

Mission 9 — Identify Administrator Access

Search for:

• AdministratorAccess
• IAMFullAccess
• PowerUserAccess

Questions:

• Who has administrator access?
• Is administrator access justified?

---

Mission 10 — Identify Privilege Escalation Opportunities

Review permissions that may allow privilege escalation.

Examples:

• iam:PassRole
• iam:CreatePolicyVersion
• iam:AttachUserPolicy
• iam:AttachRolePolicy
• iam:UpdateAssumeRolePolicy
• iam:CreateAccessKey
• sts:AssumeRole

Determine whether lower-privileged identities can obtain administrator access.

---

Mission 11 — Review Access Keys

List access keys.

aws iam list-access-keys \
--user-name USERNAME

Review:

• Active
• Inactive
• Creation Date
• Rotation Age

Identify:

• Old keys
• Unused keys
• Multiple active keys

---

Mission 12 — Review MFA

Retrieve MFA devices.

aws iam list-mfa-devices \
--user-name USERNAME

Document:

• MFA Enabled
• MFA Missing
• Administrator Accounts without MFA

---

Mission 13 — Review IAM Access Analyzer

List analyzers.

aws accessanalyzer list-analyzers

Review findings.

aws accessanalyzer list-findings \
--analyzer-name ANALYZER_NAME

Identify:

• External access
• Public access
• Cross-account access

---

Mission 14 — Visualise IAM Relationships (Optional)

Using PMapper:

pmapper graph create

Generate:

• Identity graph
• Privilege escalation paths
• Role relationships

Capture screenshots for the report.

---

Mission 15 — Build IAM Attack Paths

Example:

Developer User

↓

iam:PassRole

↓

EC2 Administrator Role

↓

AdministratorAccess

↓

Amazon S3

↓

Sensitive Customer Data

Create at least three attack paths.

---

Mission 16 — Risk Assessment

Classify findings.

Finding	Risk	Priority
Administrator without MFA	Critical	P1
Wildcard IAM Policy	Critical	P1
Excessive Developer Permissions	High	P2
Old Access Keys	Medium	P3
Unused IAM User	Low	P4

---

Mission 17 — Produce Assessment Report

Prepare:

• Executive Summary
• IAM Inventory
• Administrator Review
• Policy Review
• Trust Policy Review
• Privilege Escalation Findings
• Risk Register
• Remediation Recommendations

---

Deliverables

Create:

• IAM Asset Inventory
• IAM User Review
• IAM Role Review
• Policy Analysis
• Trust Relationship Review
• Attack Path Diagram
• Risk Register
• Executive Summary
• Technical Assessment Report

---

Validation Checklist

Verify:

• IAM Users reviewed
• IAM Groups reviewed
• IAM Roles documented
• IAM Policies analysed
• Trust policies reviewed
• Administrator accounts identified
• MFA reviewed
• Access keys reviewed
• IAM Access Analyzer findings documented
• Attack paths created
• Assessment report completed

---

Troubleshooting

Access Denied

Verify permissions:

aws sts get-caller-identity

Ensure the assessment account has IAM read-only permissions.

---

No Access Analyzer

Create or enable an analyzer (if authorised) or request that the customer enable AWS IAM Access Analyzer.

---

Empty Results

Verify:

aws configure get region

Confirm you are connected to the correct AWS account.

---

PMapper Issues

If PMapper is unavailable, manually document IAM relationships using:

• IAM Roles
• Trust Policies
• Attached Policies
• AssumeRole permissions

---

Lab Challenge

Without following the guided steps:

1. Identify every administrator identity.
2. Find all wildcard (*) permissions.
3. Locate privilege escalation opportunities.
4. Identify users without MFA.
5. Review every trust relationship.
6. Build three IAM attack paths.
7. Produce an executive IAM assessment report.

---

Knowledge Check

1. Why is IAM the primary target in cloud attacks?

Answer: IAM identities control access to cloud resources. Compromising an identity often allows attackers to move throughout the environment without exploiting operating systems.

---

2. What is the purpose of a trust policy?

Answer: A trust policy defines which principals are allowed to assume an IAM role and under what conditions.

---

3. Why is iam:PassRole considered a high-risk permission?

Answer: If combined with other permissions, iam:PassRole may allow an attacker to assign privileged roles to AWS services and indirectly gain elevated access.

---

4. Why should administrator accounts always use MFA?

Answer: Multi-Factor Authentication provides an additional layer of protection against credential theft and significantly reduces the risk of unauthorized administrative access.

---

5. What is the primary outcome of an IAM security assessment?

Answer: A clear understanding of cloud identities, permissions, trust relationships and potential privilege escalation paths, enabling organizations to reduce identity-related security risks.

---

Key Takeaways

• Identity is the foundation of cloud security and the most common target during cloud attacks.
• Professional IAM assessments focus on users, roles, policies, trust relationships and privilege escalation paths.
• Least privilege, MFA and regular access reviews significantly reduce cloud identity risk.
• Attack-path analysis provides more value than reviewing permissions in isolation.
• A well-documented IAM assessment helps organizations strengthen their overall cloud security posture.

---

What’s Next?

In the next lab, you will perform Lab 05 — Mini Cloud Penetration Test, combining reconnaissance, enumeration and IAM assessment techniques to conduct an end-to-end cloud penetration testing exercise against a realistic enterprise AWS environment.

➡️ Next Lab: Lab 05 — Mini Cloud Penetration Test