How do I install the AWS Iam Enum skill?

Run npx skillmds@latest add purpleailab/aws-iam-enum in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is AWS Iam Enum safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with AWS Iam Enum?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is AWS Iam Enum free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published AWS Iam Enum?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

AWS Iam Enum by purpleailab — Agent Skill

Name: AWS Iam Enum
Author: purpleailab

File contents

AWS IAM Enumeration + Privesc

1. Identity check

aws sts get-caller-identity
aws iam get-account-summary

2. Attached policies

aws iam list-attached-user-policies --user-name ME --output json > /tmp/attached.json
aws iam list-user-policies          --user-name ME --output json > /tmp/inline.json
aws iam list-groups-for-user        --user-name ME --output json > /tmp/groups.json

For each attached policy ARN:

aws iam get-policy --policy-arn ARN --query 'Policy.DefaultVersionId'
aws iam get-policy-version --policy-arn ARN --version-id VID > /tmp/policy.json

Then:

iam_policy_audit(open("/tmp/policy.json").read())

3. Check each privesc primitive

Rhino Security's canonical 21 paths — any Allow on these is a chain step:

iam:CreateAccessKey (other user)
iam:CreateLoginProfile
iam:UpdateLoginProfile
iam:AttachUserPolicy / iam:AttachGroupPolicy / iam:AttachRolePolicy
iam:PutUserPolicy / iam:PutGroupPolicy / iam:PutRolePolicy
iam:CreatePolicyVersion (if SetAsDefault=true)
iam:SetDefaultPolicyVersion
iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction
iam:PassRole + ec2:RunInstances
iam:PassRole + ecs:RunTask / UpdateService
glue:CreateDevEndpoint / UpdateDevEndpoint
cloudformation:CreateStack with iam:PassRole
datapipeline:CreatePipeline
lambda:UpdateFunctionCode (existing function with priv role)
iam:AddUserToGroup
iam:UpdateAssumeRolePolicy
iam:CreateRole + sts:AssumeRole
codebuild:CreateProject with iam:PassRole
sagemaker:CreateTrainingJob with iam:PassRole
aws-marketplace:Subscribe (rare, but noted)
sts:AssumeRole (direct)

4. Graph promotion

kg_add_node(kind="vulnerability", label="IAM:CreateAccessKey → account takeover", props={"severity":"critical","source":"aws-iam"})
kg_add_node(kind="crown_jewel", label="AWS Account 1234")
kg_add_edge(src=<vuln>, dst=<crown_jewel>, kind="grants", weight=0.3)

5. Common chains

Dev user has iam:PassRole + lambda:CreateFunction + a Lambda role with admin → create malicious Lambda → assume admin
iam:UpdateLoginProfile + sts:GetFederationToken → temporary console access as another user

---name: aws-iam-enumdescription: Enumerate AWS IAM policies, detect privilege escalation paths per Rhino Security Labs canonical 21 primitives.---# AWS IAM Enumeration + Privesc## 1. Identity check```bashaws sts get-caller-identityaws iam get-account-summary```## 2. Attached policies```bashaws iam list-attached-user-policies --user-name ME --output json > /tmp/attached.jsonaws iam list-user-policies --user-name ME --output json > /tmp/inline.jsonaws iam list-groups-for-user --user-name ME --output json > /tmp/groups.json```For each attached policy ARN:```bashaws iam get-policy --policy-arn ARN --query 'Policy.DefaultVersionId'aws iam get-policy-version --policy-arn ARN --version-id VID > /tmp/policy.json```Then:```iam_policy_audit(open("/tmp/policy.json").read())```## 3. Check each privesc primitiveRhino Security's canonical 21 paths — any `Allow` on these is a chain step:1. iam:CreateAccessKey (other user)2. iam:CreateLoginProfile3. iam:UpdateLoginProfile4. iam:AttachUserPolicy / iam:AttachGroupPolicy / iam:AttachRolePolicy5. iam:PutUserPolicy / iam:PutGroupPolicy / iam:PutRolePolicy6. iam:CreatePolicyVersion (if SetAsDefault=true)7. iam:SetDefaultPolicyVersion8. iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction9. iam:PassRole + ec2:RunInstances10. iam:PassRole + ecs:RunTask / UpdateService11. glue:CreateDevEndpoint / UpdateDevEndpoint12. cloudformation:CreateStack with iam:PassRole13. datapipeline:CreatePipeline14. lambda:UpdateFunctionCode (existing function with priv role)15. iam:AddUserToGroup16. iam:UpdateAssumeRolePolicy17. iam:CreateRole + sts:AssumeRole18. codebuild:CreateProject with iam:PassRole19. sagemaker:CreateTrainingJob with iam:PassRole20. aws-marketplace:Subscribe (rare, but noted)21. sts:AssumeRole (direct)## 4. Graph promotion```kg_add_node(kind="vulnerability", label="IAM:CreateAccessKey → account takeover", props={"severity":"critical","source":"aws-iam"})kg_add_node(kind="crown_jewel", label="AWS Account 1234")kg_add_edge(src=<vuln>, dst=<crown_jewel>, kind="grants", weight=0.3)```## 5. Common chains- Dev user has `iam:PassRole` + `lambda:CreateFunction` + a Lambda role with admin → create malicious Lambda → assume admin- `iam:UpdateLoginProfile` + `sts:GetFederationToken` → temporary console access as another user

Frequently asked questions

AWS Iam Enum