Cloud IAM Privilege Escalation

CriticalCloud SecurityOWASP Cloud Security

Overly permissive cloud IAM policies, misconfigured role assumptions, or excessive service account permissions enable attackers to escalate privileges and gain unauthorized access to cloud resources.

Immediate Response

1Revoke excessive IAM permissions and apply least-privilege policies immediately.
2Disable compromised IAM users, roles, or service accounts.
3Audit cloud audit logs to identify unauthorized access or privilege escalation.
4Rotate credentials for any service accounts with excessive permissions.

All playbooks

1Implement IAM permission boundaries and service control policies (SCPs).
2Enable MFA for all IAM users with console access or sensitive permissions.
3Restrict role trust policies to specific, authorized principals only.
4Deploy cloud security posture management (CSPM) for continuous IAM monitoring.

Long-term Prevention

1Implement just-in-time (JIT) access with temporary, scoped permissions.
2Conduct regular IAM access reviews and remove unused users, roles, and policies.
3Use infrastructure-as-code with policy-as-code to enforce IAM best practices.
4Implement automated IAM permission right-sizing based on actual usage patterns.

Attack vectors

IAM users or roles with excessive permissions (e.g., AdministratorAccess, Owner)
Overly permissive trust policies allowing unauthorized role assumption
Service accounts with wildcard permissions or access to all resources
Misconfigured cross-account access granting excessive permissions to external accounts

Indicators of compromise

Cloud audit logs showing unauthorized privilege escalation attempts
IAM users or roles with policies granting wildcard (*) actions or resources
Unexpected cross-account access or role assumption by external principals
Service accounts accessing resources outside their intended scope

Tooling

AWS IAM Access AnalyzerAzure AD Identity ProtectionGCP IAM RecommenderCloudSploitSteampipe