What problem does it solve?
IAM policies often contain privilege escalation paths that only emerge when combining multiple statements or attached policies. Single-statement reviews miss these deceptive combos, while naive audits over-flag neutralised grants. This skill encodes a proven SRE methodology to catch real escalation paths and correctly identify when apparent dangers are already capped by Denies, scopes, broken trusts, or permission boundaries.
Core Features & Use Cases
- Cross-policy escalation detection: Identifies privilege escalation combos that span multiple attached policies, such as iam:PassRole in one policy combined with a compute-launch action in another.
- Deceptive-clean recognition: Correctly identifies when apparent escalations are neutralised by explicit Denys, resource scoping, broken trusts, sealed conditions, or permission boundaries.
- Wildcard grant analysis: Flags dangerous wildcard patterns including Action '' on Resource '', Allow+NotAction, and service-level wildcards with accurate severity ranking.
- Trust policy exposure check: Detects open trust policies with wildcard principals lacking narrowing conditions like aws:PrincipalOrgID or sts:ExternalId.
Quick Start
Use the iam-deceptive-escalation-auditor skill to audit an AWS IAM principal by providing all its attached policy documents and asking it to identify any privilege escalation paths, over-broad grants, or whether an apparent escalation is already neutralised.
