skills.rest
cmndcntrlcyber
cmndcntrlcyberCOMMUNITY
Explore all skills by this author →
GitHub

cloud-iam-deep

Enumerate IAM, RBAC, and service accounts to identify privilege escalation paths.

3|Updated Nov 12, 2025
Search Tags:#AWS#IAM#cloud security#red team#cloud pentesting
One-click install
npx skills add https://github.com/cmndcntrlcyber/rtpi --skill cloud-iam-deep-cmndcntrlcyber
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloud-iam-deep
Source: https://github.com/cmndcntrlcyber/rtpi/tree/main/knowledge_seed/bug_hunter_skills/cloud-iam-deep
Command: npx skills add https://github.com/cmndcntrlcyber/rtpi --skill cloud-iam-deep-cmndcntrlcyber

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires boto3, azure-devops, google-cloud-storage, kubernetes, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill identifies and escalates privileges within cloud accounts, leveraging external paths and post-credential-discovery techniques for red-teaming exercises.

Core Features & Use Cases

  • IAM Enumeration: List users, roles, policies, and groups for AWS, Azure, and GCP.
  • AssumeRole Chaining: Exploit STS to assume roles across accounts.
  • Service Account JSON Abuse: Abuse service accounts in GCP for impersonation.
  • Kubernetes ServiceAccount Token Exfil: Exfiltrate and abuse Kubernetes tokens.
  • Use Case: A penetration tester is presented with an AWS key and needs to assess its scope and potential to elevate privileges within the cloud environment.

Quick Start

Run the cloud-iam-deep skill on a credential with the assumption that it is from an AWS IAM user with limited access.

Frequently Asked Questions about cloud-iam-deep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate IAM roles and policies for privilege escalation after finding an initial AWS key?▼

IAM enumeration for privilege escalation involves listing users, roles, policies, and groups to identify misconfigurations. This Skill automates that enumeration across AWS, Azure, and GCP to map out potential red-team paths after initial credential discovery.

What is the best way to exploit AssumeRole chaining across AWS accounts during a cloud pentest?▼

AssumeRole chaining exploitation leverages STS to assume roles across multiple AWS accounts. By analyzing IAM configurations, this Skill identifies and automates the exploitation of these cross-account privilege escalation paths.

Can I use this to abuse GCP service account JSON keys for impersonation?▼

Yes, GCP service account JSON abuse is supported. The Skill analyzes service account configurations to identify and exploit impersonation opportunities, allowing red teamers to escalate privileges within GCP environments.

How do I exfiltrate and abuse Kubernetes ServiceAccount tokens during a cloud red team engagement?▼

Kubernetes ServiceAccount token exfiltration targets RBAC configurations to identify exploitable tokens. This Skill enumerates Kubernetes RBAC and service account setups to facilitate token abuse and privilege escalation.

Does this Skill support external attacks and privilege analysis for Azure cloud accounts?▼

Yes, it applies to Azure cloud accounts with a focus on external attacks and privilege analysis. It performs IAM enumeration across Azure to identify potential escalation paths following an initial credential compromise.

What cloud platforms are supported for IAM red-team assessment and exploitation?▼

The supported cloud platforms are AWS, Azure, and GCP. The Skill identifies and escalates privileges within these cloud accounts by leveraging external paths and post-credential-discovery techniques.

Related Skills

Explore More Software Engineering Skills→
lloydchanglloydchang
2

rotate-secrets

Automates multi-cloud secret rotation across AWS, Azure, GCP, and on-prem systems.

Community
Advanced
jayjpatel9717jayjpatel9717

cloud-security-orchestration

Orchestrate cloud security assessments across AWS, Azure, and GCP.

Community
Advanced
hoanghn61hoanghn61

cloud-containers

Assess cloud and container environments for security misconfigurations and exploitation paths.

Community
Advanced
chatbotkitchatbotkit
13

cloud-iam-deep

Identifies and exploits cloud IAM credential exposures across AWS, Azure, and GCP.

Official
Advanced