pmapper

To find IAM privilege escalation paths, you need to build a Principal Mapper graph modeling assume and escalate pathways, then run deterministic analysis queries to identify who can reach administrative access.

The best way to check who can assume a specific IAM role is to run a targeted graph query on a built IAM principal relationship graph, which evaluates role assumption reachability and outputs deterministic JSON evidence.

Yes, you can identify which AWS principals can perform an action by running targeted graph queries on a PMapper IAM graph, allowing you to trace lateral movement and apply optional resource constraints to the analysis.

Yes, this approach detects PassRole and Lambda code injection abuse scenarios by mapping IAM principal relationships as a directed graph to identify privilege escalation pathways and administrative access reachability.

To get escalation evidence without including existing admins, run the analysis while skipping already-admin principals, which produces deterministic results showing only the strict privilege escalation paths.

You need to build or reuse a PMapper IAM graph representing your AWS account's principal relationships to run deterministic analysis or targeted graph queries for security policy validation.