AWS IAM Privilege Escalation: Mitigating Dangerous IAM Policies

AWS IAM Privilege Escalation: Hardening Cloud Access Controls

In cloud infrastructure audits, Identity and Access Management (IAM) policy misconfigurations represent the most frequent exploit path. Attackers who compromise a low-privilege developer account or container exploit IAM permissions to scale control to administrative levels.

---

Common Privilege Escalation Vectors

1. iam:CreatePolicyVersion

An attacker with this permission can create a new version of an IAM policy they are already attached to, defining administrator rights and setting it as the active version.

2. iam:PassRole & ec2:RunInstances

If an attacker can launch an EC2 instance and assign a high-privilege IAM instance profile (role) to it, they can SSH into the instance and fetch the administrator tokens from the metadata endpoint.

---

Hardening cloud access rules

• Apply Least-Privilege IAM Boundaries: Audit developer and resource roles weekly. Do not assign wildcard (*) resource rights on administrative functions.
• Block role modification access: Enforce boundaries so standard accounts cannot create policy versions or attach permissions to themselves.
• Scan configurations automatically: Integrate tools like Kube-bench and AWS IAM Access Analyzer into deployment audits.