Common Privilege Escalation Paths in AWS IAM and Prevention Strategies

The eight IAM policy-manipulation actions—including iam:PutUserPolicy, iam:AttachRolePolicy, and iam:CreatePolicy—combined with unrestricted iam:PassRole permissions, represent the most common privilege escalation vectors in AWS, which can be prevented by enforcing resource constraints, permission boundaries, and MFA-conditioned policies.

AWS Identity and Access Management (IAM) serves as the security cornerstone for cloud infrastructure, but overly permissive configurations create common privilege escalation paths in AWS IAM that allow attackers to gain unauthorized administrative access. The Agent Toolkit for AWS documents these specific vulnerabilities in its source files, providing actionable guidance for securing your environment. This article examines the exact IAM actions that enable escalation, the architectural weaknesses that allow them, and the specific mitigations implemented in the toolkit.

The Eight Critical IAM Policy Manipulation Actions

According to skills/core-skills/aws-iam/SKILL.md in the repository, eight specific IAM actions enable direct privilege escalation when granted without resource constraints:

• iam:PutUserPolicy, iam:PutRolePolicy, iam:PutGroupPolicy – Attach inline policies directly to IAM entities
• iam:CreatePolicy, iam:CreatePolicyVersion – Create managed policies or new versions that can be attached later
• iam:AttachUserPolicy, iam:AttachRolePolicy, iam:AttachGroupPolicy – Bind existing managed policies to principals

Why These Actions Enable Account Takeover

If a principal can invoke any of these eight actions with Resource: "*", they can create or attach a policy granting AdministratorAccess or other high-privilege permissions. Once attached, the attacker immediately inherits those permissions, effectively taking over the account. The toolkit specifically identifies these actions in skills/core-skills/aws-iam/SKILL.md as the primary escalation vectors requiring strict resource constraints.

The iam:PassRole Escalation Vector

The iam:PassRole permission allows a principal to pass an existing IAM role to an AWS service such as EC2, Lambda, or CloudFormation. When the resource ARN is set to * (wildcard), the principal can pass any role in the account, including highly privileged roles like AdministratorAccess.

As documented in skills/core-skills/aws-iam/SKILL.md at line 90, coupling PassRole with compute-service actions (e.g., ec2:RunInstances) creates a complete escalation path. An attacker with both permissions can launch an EC2 instance with an administrative role attached, then extract the temporary credentials from the instance metadata service to assume those privileges.

Resource-Based Policy Bypasses

Resource-based policies that grant permissions to IAM user ARNs can bypass permission boundaries, because boundaries are only evaluated for identity-based policies. This architectural gap means a low-privilege user can gain unintended rights through a resource policy attached to an S3 bucket, KMS key, or Lambda function, even when their IAM policy appears restrictive.

The toolkit notes this bypass in skills/core-skills/aws-iam/SKILL.md at line 88, emphasizing that resource-based policies should avoid granting access directly to IAM user ARNs and instead target role ARNs with specific conditions.

Prevention Strategies

Enforce Least Privilege with Resource Constraints

Never use Resource: "*" for IAM actions. Instead, scope permissions to specific resources. For iam:PassRole, restrict the resource to the exact role ARN and add a condition limiting which service can assume it:

{
  "Effect": "Allow",
  "Action": "iam:PassRole",
  "Resource": "arn:aws:iam::123456789012:role/EC2ReadOnly",
  "Condition": {
    "StringEquals": {
      "iam:PassedToService": "ec2.amazonaws.com"
    }
  }
}

Implement Permission Boundaries and SCPs

Permission boundaries cap the maximum permissions a role or user can possess, regardless of what their identity-based policies allow. Service Control Policies (SCPs) applied at the Organizational Unit (OU) level can deny the eight escalation actions globally, ensuring no principal in the organization can create privilege-escalating policies.

Require MFA for Sensitive Actions

Enforce Multi-Factor Authentication for all policy-manipulation actions using condition keys:

{
  "Effect": "Deny",
  "Action": [
    "iam:PutUserPolicy",
    "iam:CreatePolicy"
  ],
  "Resource": "*",
  "Condition": {
    "BoolIfExists": {
      "aws:MultiFactorAuthPresent": "false"
    }
  }
}

Automated Policy Generation with Agent Toolkit

The toolkit provides an autopilot tool to generate minimal IAM policies by analyzing your actual code usage. According to skills/core-skills/aws-iam/references/aws-iam-policy-generation.md, run the following command to generate least-privilege policies:

uvx iam-policy-autopilot@latest generate-policies \
  ./my_lambda/app.py ./my_lambda/handler.py \
  --region us-east-1 \
  --account 123456789012 \
  --service-hints lambda s3 \
  --pretty

This command analyzes source files and produces a concise JSON policy containing only the actions the code actually calls, eliminating unnecessary permissions that could enable escalation.

Harden Resource-Based Policies

Avoid granting permissions to IAM user ARNs in resource policies. Instead, use role-based access with explicit aws:PrincipalArn conditions. For example, a secured S3 bucket policy should reference specific role ARNs rather than wildcard user principals.

Summary

• Eight escalation actions (iam:PutUserPolicy, iam:AttachRolePolicy, iam:CreatePolicy, and five others) allow direct privilege escalation when granted without resource constraints.
• iam:PassRole with wildcard resources enables attackers to assume any role in the account by passing it to compute services.
• Resource-based policies can bypass IAM permission boundaries when granted directly to user ARNs.
• Mitigation requires enforcing resource constraints, implementing permission boundaries and SCPs, requiring MFA for policy changes, and using the Agent Toolkit's autopilot tool to generate minimal policies from code analysis.

Frequently Asked Questions

What are the 8 IAM actions that enable privilege escalation?

The eight actions are iam:PutUserPolicy, iam:PutRolePolicy, iam:PutGroupPolicy, iam:CreatePolicy, iam:CreatePolicyVersion, iam:AttachUserPolicy, iam:AttachRolePolicy, and iam:AttachGroupPolicy. These allow a principal to create, modify, or attach policies that grant themselves higher privileges, effectively enabling account takeover when combined with Resource: "*".

How does iam:PassRole lead to privilege escalation?

When iam:PassRole is granted with a wildcard resource (*), the principal can pass any IAM role—including administrative roles—to AWS services like EC2 or Lambda. By launching a resource with a high-privilege role attached, an attacker can extract the temporary credentials from that resource and assume the elevated permissions, completing the escalation path.

Can resource-based policies bypass IAM permission boundaries?

Yes. Permission boundaries only constrain identity-based policies attached to IAM users or roles. Resource-based policies (such as S3 bucket policies or KMS key policies) that grant permissions directly to IAM user ARNs can provide access that exceeds the user's permission boundary, creating an indirect escalation path.

How can I detect privilege escalation attempts in AWS?

Enable CloudTrail data events for IAM actions and configure Amazon GuardDuty to monitor for anomalous IAM usage. Create CloudWatch alarms that trigger on IAM policy changes—specifically the eight escalation actions and iam:PassRole invocations. Regularly audit permissions using the Agent Toolkit's iam-policy-autopilot command to identify and remove excess privileges before they can be exploited.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}