skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-aws-iam-privilege-escalation

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis.

954|172|Updated Mar 13, 2026
Search Tags:#AWS#iam#policy analysis#boto3#cloud security#least privilege#Privilege escalation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-aws-iam-privilege-escalation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-aws-iam-privilege-escalation
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/cloud-security/detecting-aws-iam-privilege-escalation
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-aws-iam-privilege-escalation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires boto3, cloudsplaining.

What problem does it solve?

AWS accounts often contain IAM policies with dangerous permission combinations that allow attackers to escalate privileges, and manually auditing every user, group, role, and policy for these paths is slow and error-prone.

Core Features & Use Cases

  • Privilege Escalation Detection: Analyzes policies retrieved via iam:GetAccountAuthorizationDetails for known escalation combinations such as iam:PassRole with lambda:CreateFunction, iam:CreatePolicyVersion, and sts:AssumeRole.
  • Wildcard and Least-Privilege Auditing: Flags policies using Resource: "*" with dangerous actions and maps principal-to-policy relationships into an escalation graph.
  • Severity-Scored Reporting: Produces a structured JSON report ranking findings by severity with remediation guidance, optionally with Cloudsplaining HTML reports.
  • Use Case: A security engineer auditing an AWS account before a compliance review runs this analysis to find that a developer role can pass itself to a Lambda function with an admin execution role, then validates the path with iam simulate-principal-policy before filing a remediation ticket.

Quick Start

Analyze my AWS account's IAM policies for privilege escalation paths and generate a severity-scored JSON report with remediation recommendations.

Frequently Asked Questions about detecting-aws-iam-privilege-escalation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect AWS IAM privilege escalation paths?▼

Call iam:GetAccountAuthorizationDetails with boto3 to retrieve all users, groups, roles, and policies, then check each policy for known escalation combinations like iam:PassRole with lambda:CreateFunction, iam:CreatePolicyVersion, and sts:AssumeRole. Score findings by severity and validate paths with iam simulate-principal-policy.

What AWS permissions are needed to audit IAM policies for privilege escalation?▼

You need IAM read-only access, specifically iam:GetAccountAuthorizationDetails, plus Python 3.8+ with the boto3 library installed. The cloudsplaining package is optional and only used for HTML report generation.

Why does GetAccountAuthorizationDetails miss some privilege escalation paths?▼

It returns attached, inline, and group policies but not permission boundaries, SCPs, session policies, or resource-based policies. A flagged path may be blocked by a boundary (false positive) or enabled by an unparsed trust policy (false negative), so reconcile against boundaries and trust policies before reporting.

How do I validate an IAM privilege escalation finding is real?▼

Run aws iam simulate-principal-policy with the principal ARN and the escalation action names, since the simulator honors permission boundaries and SCPs. For full confidence, exercise the escalation chain in an isolated test account rather than relying on substring matching alone.

What are the limitations of IAM privilege escalation policy scanning?▼

Naive substring matching ignores NotAction and Deny statements, Condition keys like MFA or aws:PrincipalTag, and non-default policy versions where attackers stage admin access. It also misses lesser-known vectors like iam:PutUserPolicy, iam:UpdateAssumeRolePolicy, and PassRole paired with glue, cloudformation, or sagemaker.

Related Skills

Explore More Software Engineering Skills→
dgethingsdgethings

aws-security-audit

Inspect IAM users, roles, policies, and CloudTrail events across AWS accounts.

Community
Advanced
balsm-healthbalsm-health
2

implementing-aws-iam-permission-boundaries

Configure AWS IAM permission boundaries to enforce least privilege on roles and policies using CLI/boto3 workflows.

Official
Advanced
webrix-aiwebrix-ai
1

security-alert-triage

Classifies AWS GuardDuty and CloudTrail alerts and routes urgent ones to Slack/PagerDuty.

Official
Advanced
balsm-healthbalsm-health
2

implementing-cloud-security-posture-management

Automate continuous security posture monitoring across AWS, Azure, and GCP.

Official
Advanced