Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations
Start a fresh conversation. Replace the highlighted placeholders.
Use detecting-aws-iam-privilege-escalation to analyze [an AWS account you authorize] with IAM read-only access for privilege-escalation paths, producing a severity-ranked JSON report of dangerous permission combinations, wildcard-resource findings, principal relationships, and least-privilege remediation.
Required inputs
[an AWS account you authorize]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: detecting-aws-iam-privilege-escalationdescription: Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violationsdomain: cybersecuritysubdomain: cloud-securitytags: - aws- iam- privilege-escalation- cloudsplaining- boto3- policy-analysis- least-privilegeversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.IR-01- ID.AM-08- GV.SC-06- DE.CM-01mitre_attack: - T1098.001- T1098.003- T1078.004- T1548.005- T1484
Detecting AWS IAM Privilege Escalation
Overview
This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.
When to Use
When investigating security incidents that require detecting aws iam privilege escalation
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Python 3.8+ with boto3 library
AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
Optional: cloudsplaining Python package for HTML report generation
Steps
Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
Score and Prioritize Findings — Rank findings by severity based on escalation vector type
Generate Report — Produce structured JSON report with remediation guidance
Expected Output
JSON report of privilege escalation findings with severity scores
List of dangerous permission combinations per principal