cloud-iam-deep

Cloud IAM enumeration maps exposed AWS access keys, Azure secrets, GCP service account JSON, and Kubernetes SA tokens to determine their granted permissions and identify misconfigurations across AWS, Azure, and GCP.

Cross-account role chaining via STS assume-role is a privilege escalation technique that sequences role assumptions across accounts to expand access. It maps how compromised credentials can be weaponized to traverse AWS environments.

AWS Cognito unauthenticated-role attack chains are exploited by analyzing identity pool configurations to obtain temporary credentials. This technique maps the escalation path from unauthenticated access to broader AWS IAM privileges.

Yes, Kubernetes SA token exposure can be mapped to cloud privilege escalation paths. The workflow analyzes K8s SA tokens alongside AWS, Azure, and GCP credentials to document post-exploitation and cross-cloud escalation patterns.

Yes, the workflow specifically applies to credentials surfaced through SSRF flows to IMDS. It processes exposed credentials from code repositories, APKs, breach datasets, and IMDS to perform IAM enumeration and escalation path analysis.

Azure Managed Identity abuse is a privilege escalation technique targeting cloud-assigned identities. It maps how compromised credentials exploit managed identities to escalate privileges and traverse Azure RBAC boundaries.