# Cloud Iam Privesc

> Escalate privileges in cloud IAM (AWS/GCP/Azure) from a low-priv set of credentials. Load when you hold cloud creds/keys/a role and want higher privilege or new resources. Signals: leaked AWS keys, an assumed role, a service-account token, "escalate in AWS/GCP/Azure", enumerated permissions.

- Skill: `noorqureshi/cloud-iam-privesc` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/cloud-iam-privesc`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/cloud-iam-privesc/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/cloud-iam-privesc

---


# Cloud IAM privilege escalation

## When it applies
You have some cloud identity (leaked keys, an SSRF-obtained role — `cloud-imds-ssrf`, a
compromised service account) and want to escalate to admin or reach more resources.

## Why it works
IAM is complex and permissions are over-granted. A handful of seemingly-minor permissions form
known escalation paths — creating a policy version, attaching a policy, passing a role, updating a
function's code/role — that promote a low-priv identity to admin.

## Method
1. **Identify & enumerate**: `aws sts get-caller-identity`; enumerate your effective permissions
   (`enumerate-iam`, `pacu`, or read attached policies). GCP: `gcloud ... get-iam-policy`; Azure: `az role assignment list`.
2. **Find an escalation primitive** (AWS examples):
   - `iam:CreatePolicyVersion` / `SetDefaultPolicyVersion` → grant yourself `*`.
   - `iam:AttachUserPolicy` / `PutUserPolicy` → attach AdministratorAccess.
   - `iam:PassRole` + `lambda:CreateFunction`/`ec2:RunInstances`/`glue`/`cloudformation` → run code as a privileged role.
   - `iam:CreateAccessKey` on another user; `sts:AssumeRole` on an over-trusting role.
   GCP: `iam.serviceAccounts.actAs`, `setIamPolicy`, editor→owner via `deploymentmanager`.
3. **Execute the path** (in scope), then confirm elevated access with a read-only admin call.
4. **Automate discovery** with `pacu` (AWS) escalation modules / ScoutSuite for the landscape.

## Gotchas
- Enumerate permissions first — escalation depends entirely on which ones you hold.
- Prove escalation with a minimal, reversible action; don't create lasting admin backdoors on a live account (RoE).
- Temp creds expire — capture `get-caller-identity` before and after as proof.

## Verify success
You gain permissions/resources beyond your starting identity (e.g. an admin-only call now
succeeds, or you assume a higher-priv role), demonstrated with before/after identity.

## References
Rhino Security "AWS IAM privilege escalation" methods; Pacu; GCP/Azure privesc guides; ScoutSuite.