How do I install the Cloud Iam Privesc skill?

Run npx skillmds@latest add noorqureshi/cloud-iam-privesc in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cloud Iam Privesc safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cloud Iam Privesc?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cloud Iam Privesc free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cloud Iam Privesc?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cloud Iam Privesc by noorqureshi — Agent Skill

Name: Cloud Iam Privesc
Author: NoorQureshi

Cloud Iam Privesc

Escalate privileges in cloud IAM (AWS/GCP/Azure) from a low-priv set of credentials. Load when you hold cloud creds/keys/a role and want higher privilege or new resources. Signals: leaked AWS keys, an assumed role, a service-account token, "escalate in AWS/GCP/Azure", enumerated permissions.

NoorQureshi Updated Sep 17, 2026

File contents

Cloud IAM privilege escalation

When it applies

You have some cloud identity (leaked keys, an SSRF-obtained role — cloud-imds-ssrf, a compromised service account) and want to escalate to admin or reach more resources.

Why it works

IAM is complex and permissions are over-granted. A handful of seemingly-minor permissions form known escalation paths — creating a policy version, attaching a policy, passing a role, updating a function's code/role — that promote a low-priv identity to admin.

Method

Identify & enumerate: aws sts get-caller-identity; enumerate your effective permissions (enumerate-iam, pacu, or read attached policies). GCP: gcloud ... get-iam-policy; Azure: az role assignment list.
Find an escalation primitive (AWS examples):
- iam:CreatePolicyVersion / SetDefaultPolicyVersion → grant yourself *.
- iam:AttachUserPolicy / PutUserPolicy → attach AdministratorAccess.
- iam:PassRole + lambda:CreateFunction/ec2:RunInstances/glue/cloudformation → run code as a privileged role.
- iam:CreateAccessKey on another user; sts:AssumeRole on an over-trusting role. GCP: iam.serviceAccounts.actAs, setIamPolicy, editor→owner via deploymentmanager.
Execute the path (in scope), then confirm elevated access with a read-only admin call.
Automate discovery with pacu (AWS) escalation modules / ScoutSuite for the landscape.

Gotchas

Enumerate permissions first — escalation depends entirely on which ones you hold.
Prove escalation with a minimal, reversible action; don't create lasting admin backdoors on a live account (RoE).
Temp creds expire — capture get-caller-identity before and after as proof.

Verify success

You gain permissions/resources beyond your starting identity (e.g. an admin-only call now succeeds, or you assume a higher-priv role), demonstrated with before/after identity.

References

Rhino Security "AWS IAM privilege escalation" methods; Pacu; GCP/Azure privesc guides; ScoutSuite.

---name: cloud-iam-privescdescription: Escalate privileges in cloud IAM (AWS/GCP/Azure) from a low-priv set of credentials. Load when you hold cloud creds/keys/a role and want higher privilege or new resources. Signals: leaked AWS keys, an assumed role, a service-account token, "escalate in AWS/GCP/Azure", enumerated permissions.---# Cloud IAM privilege escalation## When it appliesYou have some cloud identity (leaked keys, an SSRF-obtained role — `cloud-imds-ssrf`, acompromised service account) and want to escalate to admin or reach more resources.## Why it worksIAM is complex and permissions are over-granted. A handful of seemingly-minor permissions formknown escalation paths — creating a policy version, attaching a policy, passing a role, updating afunction's code/role — that promote a low-priv identity to admin.## Method1. **Identify & enumerate**: `aws sts get-caller-identity`; enumerate your effective permissions (`enumerate-iam`, `pacu`, or read attached policies). GCP: `gcloud ... get-iam-policy`; Azure: `az role assignment list`.2. **Find an escalation primitive** (AWS examples): - `iam:CreatePolicyVersion` / `SetDefaultPolicyVersion` → grant yourself `*`. - `iam:AttachUserPolicy` / `PutUserPolicy` → attach AdministratorAccess. - `iam:PassRole` + `lambda:CreateFunction`/`ec2:RunInstances`/`glue`/`cloudformation` → run code as a privileged role. - `iam:CreateAccessKey` on another user; `sts:AssumeRole` on an over-trusting role. GCP: `iam.serviceAccounts.actAs`, `setIamPolicy`, editor→owner via `deploymentmanager`.3. **Execute the path** (in scope), then confirm elevated access with a read-only admin call.4. **Automate discovery** with `pacu` (AWS) escalation modules / ScoutSuite for the landscape.## Gotchas- Enumerate permissions first — escalation depends entirely on which ones you hold.- Prove escalation with a minimal, reversible action; don't create lasting admin backdoors on a live account (RoE).- Temp creds expire — capture `get-caller-identity` before and after as proof.## Verify successYou gain permissions/resources beyond your starting identity (e.g. an admin-only call nowsucceeds, or you assume a higher-priv role), demonstrated with before/after identity.## ReferencesRhino Security "AWS IAM privilege escalation" methods; Pacu; GCP/Azure privesc guides; ScoutSuite.

Frequently asked questions