The IAM Privilege Escalation Threat
AWS IAM privilege escalation occurs when a user with limited permissions leverages their existing access to gain higher privileges. Researchers have identified 21+ distinct escalation paths, many of which go undetected by standard security tools.
Key Escalation Paths
1. iam:CreatePolicyVersion
A user who can create new policy versions can write a policy granting themselves full access:
{
"Version": "2012-10-17",
"Statement": [{"Effect": "Allow", "Action": "*", "Resource": "*"}]
}
2. iam:PassRole + Lambda
Pass an admin role to a Lambda function, then invoke it:
aws lambda create-function --role arn:aws:iam::123:role/AdminRole ...
aws lambda invoke --function-name escalate output.txt
3. iam:PassRole + EC2
Launch an EC2 instance with an admin instance profile, then access the metadata service.
4. iam:AttachUserPolicy
Directly attach AdministratorAccess to your own user.
5. iam:PutUserPolicy
Create an inline policy granting full access.
6. sts:AssumeRole
Assume a more privileged role if the trust policy is misconfigured.
7. Lambda + Environment Variables
Modify a Lambda's environment variables to inject credentials or change behavior.
8. CloudFormation Stack
Create a CloudFormation stack with resources that grant escalated privileges.
Detection Strategies
CloudTrail Analysis
Monitor for suspicious IAM API calls:
CreatePolicyVersion,AttachUserPolicy,PutUserPolicyPassRoleto high-privilege rolesAssumeRoleto admin roles from unexpected principals
Automated Scanning
Tools like Prowler and ScoutSuite analyze IAM configurations for escalation paths.
IAM Access Analyzer
AWS-native tool that identifies external access and unused permissions.
Prevention
- Use Permission Boundaries to cap maximum permissions
- Separate Duties: no single user should have IAM write + compute permissions
- Audit Regularly with automated IAM analysis
- Enable MFA for privileged operations
- Use SCPs (Service Control Policies) for organization-wide guardrails
Where SuperClue Fits
SuperClue does not connect to your AWS account, so it does not map IAM escalation paths. On EC2, a bootstrap script installs the SuperClue Linux SOC agent, and the DAST scanner tests the web applications and APIs you expose.