iam-privilege-escalation-audit

To audit cloud IAM policies for privilege escalation, analyze identity permissions, trust policies, and role assignments to detect reachable paths to administrative control across AWS, GCP, and Azure. This validates configurations against least-privilege principles.

PassRole abuse in AWS IAM is a privilege escalation vector where a low-privilege identity uses wildcard permissions to pass a privileged role to another resource. Auditing detects these dangerous combinations to prevent unauthorized lateral movement.

Yes, you can scan Terraform IaC or existing cloud policies to identify if a CI/CD service account has the ability to grant itself owner permissions, assume privileged roles, or make shadow-admin policy edits across AWS, GCP, and Azure.

Rank IAM privilege escalation findings by exploitability using a structured triage methodology that evaluates reachability and exploitability. This ensures security teams focus on the most critical security misconfigurations and apply remediation strategies first.

This IAM audit supports GCP and Azure environments alongside AWS. It analyzes identity permissions and role assignments across all three cloud providers to detect privilege escalation vectors and validate least-privilege configurations.

The best way to remediate wildcard permissions in cloud IAM is to apply the provided remediation strategies that validate configurations against least-privilege principles, replacing broad access with explicit permissions to block administrative control paths.