iam-deceptive-escalation-auditor

What problem does it solve?

IAM policies often contain privilege escalation paths that only emerge when combining multiple statements or attached policies. Single-statement reviews miss these deceptive combos, while naive audits over-flag neutralised grants. This skill encodes a proven SRE methodology to catch real escalation paths and correctly identify when apparent dangers are already capped by Denies, scopes, broken trusts, or permission boundaries.

Core Features & Use Cases

• Cross-policy escalation detection: Identifies privilege escalation combos that span multiple attached policies, such as iam:PassRole in one policy combined with a compute-launch action in another.
• Deceptive-clean recognition: Correctly identifies when apparent escalations are neutralised by explicit Denys, resource scoping, broken trusts, sealed conditions, or permission boundaries.
• Wildcard grant analysis: Flags dangerous wildcard patterns including Action '' on Resource '', Allow+NotAction, and service-level wildcards with accurate severity ranking.
• Trust policy exposure check: Detects open trust policies with wildcard principals lacking narrowing conditions like aws:PrincipalOrgID or sts:ExternalId.

Quick Start

Use the iam-deceptive-escalation-auditor skill to audit an AWS IAM principal by providing all its attached policy documents and asking it to identify any privilege escalation paths, over-broad grants, or whether an apparent escalation is already neutralised.