cloud-iam-privesclisted

# Cloud IAM privilege escalation ## When it applies You have some cloud identity (leaked keys, an SSRF-obtained role — `cloud-imds-ssrf`, a compromised service account) and want to escalate to admin or reach more resources. ## Why it works IAM is complex and permissions are over-granted. A handful of seemingly-minor permissions form known escalation paths — creating a policy version, attaching a policy, passing a role, updating a function's code/role — that promote a low-priv identity to admin. ## Method 1. **Identify & enumerate**: `aws sts get-caller-identity`; enumerate your effective permissions (`enumerate-iam`, `pacu`, or read attached policies). GCP: `gcloud ... get-iam-policy`; Azure: `az role assignment list`. 2. **Find an escalation primitive** (AWS examples): - `iam:CreatePolicyVersion` / `SetDefaultPolicyVersion` → grant yourself `*`. - `iam:AttachUserPolicy` / `PutUserPolicy` → attach AdministratorAccess. - `iam:PassRole` + `lambda:CreateFunction`/`ec2:RunInstances`/`glue`/`cloudformation` → run code as a privileged role. - `iam:CreateAccessKey` on another user; `sts:AssumeRole` on an over-trusting role. GCP: `iam.serviceAccounts.actAs`, `setIamPolicy`, editor→owner via `deploymentmanager`. 3. **Execute the path** (in scope), then confirm elevated access with a read-only admin call. 4. **Automate discovery** with `pacu` (AWS) escalation modules / ScoutSuite for the landscape. ## Gotchas - Enumerate permissions first — escalation depends enti