Lesson 02 — IAM Exploitation

Learning Objectives

By the end of this lesson, you will be able to:

Understand why IAM is the primary attack target in AWS.
Identify common IAM attack techniques.
Understand privilege escalation in AWS.
Analyze IAM trust relationships.
Recognize risky IAM permissions.
Understand enterprise IAM assessment methodologies.

Introduction

Identity is the most valuable asset inside AWS.

Unlike traditional environments where attackers often exploit operating systems first, AWS attackers usually focus on identities and permissions.

If an attacker compromises a privileged IAM identity, they may gain access to:

Amazon EC2
Amazon S3
Amazon RDS
AWS Lambda
Amazon EKS
Secrets Manager
KMS
CloudTrail
Entire AWS Accounts

This is why IAM assessments are always one of the first activities during professional AWS penetration testing engagements.

Why IAM Is the Primary Target

AWS permissions determine who can perform which actions.

An attacker does not need to exploit AWS infrastructure.

Instead, they exploit weak permissions.

Examples include:

Administrator users without MFA
Exposed Access Keys
Wildcard IAM policies
Weak AssumeRole permissions
Long-lived credentials
Overly permissive Service Roles

Identity compromise frequently leads to complete cloud compromise.

Enterprise Scenario

CloudNova Technologies has been hired to assess the AWS IAM environment of FinSecure Bank Ltd.

The customer wants to answer several important questions:

Who has administrator privileges?
Can developers escalate privileges?
Are IAM roles overly permissive?
Are trust relationships secure?
Can attackers move between AWS accounts?

Your task is to assess IAM from an attacker’s perspective.

AWS IAM Components

AWS IAM consists of several core components.

IAM

│

├── Users

├── Groups

├── Roles

├── Policies

├── Access Keys

├── MFA

└── Trust Policies

Every component should be reviewed during an assessment.

Common IAM Attack Surface

Attackers typically target:

IAM Users
IAM Roles
IAM Policies
Temporary Credentials
Access Keys
STS Tokens
Service Accounts
Federation
Cross-Account Trust

These identities often provide direct access to sensitive cloud resources.

IAM Attack Lifecycle

A typical attack follows this sequence.

Credential Discovery

↓

IAM Enumeration

↓

Permission Analysis

↓

Privilege Escalation

↓

AssumeRole

↓

Administrator Access

↓

Cloud Resource Access

↓

Persistence

Understanding this lifecycle helps identify opportunities to interrupt attacks.

Initial Enumeration

Professional penetration testers begin by enumerating IAM resources.

Examples:

aws iam list-users

aws iam list-roles

aws iam list-groups

aws iam list-policies

The goal is to understand the identity landscape before testing permissions.

Common IAM Misconfigurations

Examples include:

AdministratorAccess attached to unnecessary users
Wildcard (*) permissions
Long-lived access keys
Missing MFA
Unused administrator accounts
Root account usage
Excessive AssumeRole permissions
Cross-account trust with external principals
Service roles with unnecessary privileges

These weaknesses are frequently observed during enterprise assessments.

Privilege Escalation

Privilege escalation occurs when a lower-privileged identity gains higher privileges.

Example:

Developer User

↓

iam:PassRole

↓

EC2 Instance

↓

Administrator Role

↓

Administrator Access

The attacker never directly receives administrator permissions but abuses an existing privileged role.

High-Risk IAM Permissions

Certain IAM permissions should always receive additional scrutiny.

Permission	Risk
iam:PassRole	High
sts:AssumeRole	High
iam:AttachUserPolicy	Critical
iam:AttachRolePolicy	Critical
iam:CreatePolicyVersion	Critical
iam:SetDefaultPolicyVersion	Critical
iam:PutUserPolicy	High
iam:UpdateAssumeRolePolicy	Critical
iam:CreateAccessKey	High
iam:CreateLoginProfile	High

These permissions can often be chained together to obtain elevated access.

IAM Trust Relationships

IAM roles use trust policies to define who may assume them.

Example:

{
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:root"
  },
  "Action": "sts:AssumeRole"
}

Review:

Trusted principals
Wildcards
Cross-account access
External identities

Weak trust relationships are a common source of privilege escalation.

Temporary Credentials

AWS commonly uses temporary credentials.

Generated through:

STS
AssumeRole
EC2 Instance Profiles
Lambda Execution Roles
EKS IRSA

Advantages:

Short lifetime
Automatic rotation
Reduced credential exposure

Attackers frequently attempt to steal temporary credentials from workloads.

Common IAM Attack Techniques

Attackers may attempt to:

Enumerate IAM identities.
Discover administrator accounts.
Identify wildcard permissions.
Abuse iam:PassRole.
Abuse sts:AssumeRole.
Create new access keys.
Attach administrator policies.
Create new privileged users.
Disable monitoring.
Maintain persistence.

Understanding these techniques helps defenders detect suspicious activity.

IAM Attack Path Example

Compromised Developer Credentials

↓

IAM User

↓

sts:AssumeRole

↓

Administrator Role

↓

Amazon EC2

↓

Secrets Manager

↓

Production Database

This illustrates how a single identity compromise can affect multiple AWS services.

Enterprise Assessment Workflow

Professional consultants typically follow this process.

Enumerate IAM

↓

Review Policies

↓

Review Trust Relationships

↓

Identify Privilege Escalation

↓

Assess MFA

↓

Review Access Keys

↓

Map Attack Paths

↓

Document Findings

This structured approach ensures consistent and comprehensive assessments.

Common Enterprise Findings

Frequently observed issues include:

Administrator users without MFA
IAM users with unused access keys
Roles trusted by multiple accounts
Wildcard permissions (Action: "*")
Excessive iam:PassRole
Long-lived access keys
Shared administrator accounts
Root account usage
Weak role separation
Poor credential rotation

Defensive Best Practices

To strengthen IAM security:

Enable MFA for all privileged identities.
Enforce least privilege.
Rotate access keys regularly.
Eliminate long-lived credentials where possible.
Use IAM Roles instead of permanent credentials.
Review trust relationships periodically.
Remove unused identities.
Enable IAM Access Analyzer.
Continuously monitor IAM changes using CloudTrail.

Common Mistakes

Avoid:

Granting AdministratorAccess by default.
Using the AWS root account for daily work.
Sharing IAM users between administrators.
Creating permanent credentials for applications.
Ignoring unused identities.
Allowing unrestricted AssumeRole permissions.
Leaving administrator accounts without MFA.

Knowledge Check

1. Why is IAM considered the primary attack target in AWS?

Answer: IAM controls access to AWS resources. Compromising an identity often provides attackers with direct access to cloud infrastructure and sensitive data.

2. What is privilege escalation?

Answer: Privilege escalation is the process of gaining higher permissions than originally assigned by abusing IAM configurations, trust relationships or overly permissive policies.

3. Why is `iam:PassRole` considered dangerous?

Answer: It can allow attackers to assign privileged IAM roles to AWS services, indirectly obtaining elevated access without directly modifying their own permissions.

4. What is the purpose of an IAM trust policy?

Answer: A trust policy defines which principals are allowed to assume an IAM role and under what conditions.

5. Why are temporary credentials preferred over long-lived access keys?

Answer: Temporary credentials expire automatically, reducing the risk of credential theft and long-term unauthorized access.

Key Takeaways

IAM is the foundation of AWS security and the primary target during cloud attacks.
Professional AWS assessments begin with identity enumeration and permission analysis.
Privilege escalation often results from overly permissive IAM policies and weak trust relationships.
Attack-path analysis provides greater insight than reviewing identities individually.
Strong IAM governance—including least privilege, MFA and continuous monitoring—significantly reduces cloud security risk.

What’s Next?

In the next lesson, you will learn AWS Organizations Assessment, where you will explore how enterprise AWS environments are structured, assess multi-account security, review Service Control Policies (SCPs), delegated administration and cross-account trust relationships.

➡️ Next Lesson: Lesson 03 — AWS Organizations Assessment