cloud-iam-deep

Map cloud-identity credentials and determine their privileges across AWS, Azure, and GCP.

3.3k|507|Updated May 5, 2026

Search Tags:#ssrf #privilege-escalation #sts #cognito #cross-account #cloud-iam #k8s-sa-token

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill cloud-iam-deep-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cloud-iam-deep
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/cloud-iam-deep
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill cloud-iam-deep-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cloud IAM red-team workflows across major public clouds provide a structured approach to identifying exposed credentials, mapping their privileges, and chaining them to privilege escalation. This skill consolidates techniques for AWS IAM, Azure RBAC, GCP IAM, STS/assume-role chains, managed identities, and Kubernetes service accounts to reveal how compromised credentials can be weaponized in cloud environments.

Core Features & Use Cases

IAM enumeration across AWS, Azure, and GCP to determine granted permissions and potential misconfigurations.
Cross-account and cross-cloud privilege escalation via STS assume-role, managed identities, and SA token abuse patterns.
Coverage of AWS Cognito unauthenticated-role attack chains and K8s SA token exposure with post-exploitation analysis.

Quick Start

Execute cloud-iam-deep to enumerate credentials across AWS, Azure, and GCP, map their privileges, and outline escalation paths.

Frequently Asked Questions about cloud-iam-deep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate cloud IAM privileges from exposed AWS access keys or GCP service account JSON?▼

Cloud IAM enumeration maps exposed AWS access keys, Azure secrets, GCP service account JSON, and Kubernetes SA tokens to determine their granted permissions and identify misconfigurations across AWS, Azure, and GCP.

What is cross-account role chaining via STS assume-role in AWS?▼

Cross-account role chaining via STS assume-role is a privilege escalation technique that sequences role assumptions across accounts to expand access. It maps how compromised credentials can be weaponized to traverse AWS environments.

How do I exploit AWS Cognito unauthenticated-role attack chains?▼

AWS Cognito unauthenticated-role attack chains are exploited by analyzing identity pool configurations to obtain temporary credentials. This technique maps the escalation path from unauthenticated access to broader AWS IAM privileges.

Can I map Kubernetes SA token exposure to cloud privilege escalation paths?▼

Yes, Kubernetes SA token exposure can be mapped to cloud privilege escalation paths. The workflow analyzes K8s SA tokens alongside AWS, Azure, and GCP credentials to document post-exploitation and cross-cloud escalation patterns.

Does this workflow handle credentials exposed through SSRF flows to IMDS?▼

Yes, the workflow specifically applies to credentials surfaced through SSRF flows to IMDS. It processes exposed credentials from code repositories, APKs, breach datasets, and IMDS to perform IAM enumeration and escalation path analysis.

What is Azure Managed Identity abuse in cloud red-team workflows?▼

Azure Managed Identity abuse is a privilege escalation technique targeting cloud-assigned identities. It maps how compromised credentials exploit managed identities to escalate privileges and traverse Azure RBAC boundaries.