Lab 01 — AWS IAM Enumeration

Lab Information

Item	Value
Module	02 — AWS Cloud Penetration Testing
Lab	01 — AWS IAM Enumeration
Difficulty	Intermediate
Estimated Time	90 Minutes
Lab Type	AWS Offensive Security
Tools	AWS CLI, IAM, IAM Access Analyzer, PMapper (Optional), Pacu (Optional)
Prerequisites	AWS Account, AWS CLI Configured, Read-Only IAM Permissions
Assessment Type	Enterprise IAM Security Review

Mission Brief

You are a Cloud Penetration Tester at CloudNova Technologies.

Your client, FinSecure Bank Ltd, has requested an enterprise IAM security assessment to determine whether attackers could abuse AWS identities to gain unauthorized access.

Your mission is to enumerate the AWS IAM environment, identify privileged identities, analyze IAM policies, discover trust relationships and identify potential privilege escalation opportunities.

Learning Objectives

After completing this lab, you will be able to:

Enumerate IAM users, groups and roles.
Review IAM policies and permissions.
Identify privileged identities.
Discover trust relationships.
Review access keys and MFA configuration.
Identify privilege escalation opportunities.
Produce an enterprise IAM assessment report.

Enterprise Environment

The AWS environment contains:

AWS Organizations
Multiple AWS Accounts
IAM Users
IAM Groups
IAM Roles
Cross-Account Roles
EC2 Instance Profiles
Lambda Execution Roles
Amazon EKS IRSA Roles

Your objective is to map the complete IAM attack surface.

Lab Architecture

AWS Account

↓

IAM

├── Users
├── Groups
├── Roles
├── Policies
├── Access Keys
├── MFA
├── Instance Profiles
├── Cross-Account Roles
└── Service Roles

Success Criteria

You successfully complete this lab when you can:

Enumerate all IAM users.
Enumerate all IAM roles.
Review IAM policies.
Identify administrator accounts.
Identify excessive permissions.
Review trust relationships.
Produce an IAM security assessment.

Task 1 — Verify AWS Access

Confirm your AWS CLI configuration.

aws sts get-caller-identity

Expected Output

Account ID

User ARN

User ID

Questions

Which AWS account are you assessing?
Which identity are you using?
Is this an IAM User or IAM Role?

Task 2 — Enumerate IAM Users

List all IAM users.

aws iam list-users

Document:

User Name
ARN
Creation Date
Path

Questions

How many IAM users exist?
Are any unused?
Are naming conventions consistent?

Task 3 — Enumerate IAM Groups

List IAM groups.

aws iam list-groups

For each group:

aws iam get-group \
--group-name GROUP_NAME

Review:

Members
Attached policies
Purpose

Questions

Which groups have administrator privileges?
Are developers separated from administrators?

Task 4 — Enumerate IAM Roles

List all IAM roles.

aws iam list-roles

Review a role.

aws iam get-role \
--role-name ROLE_NAME

Identify:

Administrator roles
EC2 roles
Lambda roles
EKS IRSA roles
Cross-account roles

Task 5 — Review Attached Policies

List managed policies.

aws iam list-policies

Review attached policies.

aws iam list-attached-role-policies \
--role-name ROLE_NAME

Questions

Which roles use AdministratorAccess?
Which policies contain wildcard permissions?
Are custom policies documented?

Task 6 — Review Inline Policies

Retrieve inline policies.

aws iam list-role-policies \
--role-name ROLE_NAME

Retrieve policy.

aws iam get-role-policy \
--role-name ROLE_NAME \
--policy-name POLICY_NAME

Review:

Wildcard Actions
Wildcard Resources
Dangerous IAM permissions

Task 7 — Identify High-Risk Permissions

Search for permissions such as:

iam:PassRole
sts:AssumeRole
iam:AttachRolePolicy
iam:CreatePolicyVersion
iam:SetDefaultPolicyVersion
iam:PutRolePolicy
iam:CreateAccessKey

Document every identity with these permissions.

Task 8 — Review Trust Relationships

Retrieve trust policy.

aws iam get-role \
--role-name ROLE_NAME

Review:

Principal

Action

Condition

Questions

Are external AWS accounts trusted?
Are wildcard principals used?
Are trust conditions present?

Task 9 — Review MFA

List virtual MFA devices.

aws iam list-virtual-mfa-devices

Review administrator users.

Determine:

MFA Enabled
MFA Missing

Questions

Which privileged users do not use MFA?

Task 10 — Review Access Keys

List access keys.

aws iam list-access-keys \
--user-name USERNAME

Review:

Active Keys
Key Age
Unused Keys

Questions

Which keys should be rotated?
Which users have multiple active keys?

Task 11 — Review IAM Access Analyzer

List analyzers.

aws accessanalyzer list-analyzers

Retrieve findings.

aws accessanalyzer list-findings \
--analyzer-name ANALYZER_NAME

Document:

Public Access
Cross-Account Access
Resource Sharing

Task 12 — Build an IAM Attack Graph

Create an attack graph similar to:

Developer User

↓

PassRole

↓

EC2 Administrator Role

↓

AdministratorAccess

↓

Amazon S3

↓

Sensitive Customer Data

Identify all privilege escalation opportunities.

Task 13 — Risk Assessment

Classify findings.

Finding	Severity
Administrator Without MFA	Critical
Wildcard IAM Policy	High
iam:PassRole Abuse	Critical
Cross-Account Trust	High
Long-Lived Access Keys	High
Shared IAM Users	Medium

Task 14 — Executive Recommendations

Recommend improvements including:

Enable MFA
Remove wildcard permissions
Implement least privilege
Rotate access keys
Enable IAM Access Analyzer
Review trust relationships
Separate administrative duties
Perform quarterly IAM reviews

Bonus Challenge

Use PMapper to visualize privilege escalation paths.

Example:

pmapper graph create

Or use Pacu to enumerate IAM permissions.

Document any additional attack paths identified.

Deliverables

Prepare an assessment containing:

IAM User Inventory
IAM Role Inventory
Administrator Accounts
High-Risk Permissions
Trust Relationship Review
Privilege Escalation Opportunities
Executive Summary
Remediation Plan

Expected Outcome

After completing this lab, you will have:

Enumerated the enterprise IAM environment.
Identified privileged identities.
Discovered excessive IAM permissions.
Mapped trust relationships.
Identified privilege escalation paths.
Produced a professional enterprise IAM assessment report.

Key Takeaways

IAM is the foundation of AWS security and the primary target for cloud attackers.
Enumeration is the first step in identifying privilege escalation opportunities.
High-risk permissions such as iam:PassRole and sts:AssumeRole require careful review.
Trust relationships should be regularly audited to prevent unauthorized access.
Continuous IAM governance and least-privilege principles significantly reduce enterprise cloud risk.

Next Lab

➡️ Lab 02 — Amazon S3 Misconfiguration Assessment