Detecting AWS IAM Privilege Escalation
FreeIdentify and analyze AWS IAM privilege escalation paths.
Free · Opens the source repo
What Detecting AWS IAM Privilege Escalation does
The Detecting AWS IAM Privilege Escalation skill is designed to help security professionals analyze AWS IAM policies for potential privilege escalation vulnerabilities. By utilizing the boto3 library and Cloudsplaining-style analysis, this skill automates the process of retrieving IAM authorization details and scrutinizing policies for dangerous permission combinations. The skill specifically looks for common escalation paths, such as the combination of iam:PassRole and lambda:CreateFunction, which can lead to significant security risks if not properly managed.
This skill is particularly useful for security operations center (SOC) analysts and incident responders who need to ensure that AWS environments adhere to least-privilege principles. By identifying overly permissive policies and dangerous permission combinations, users can take proactive steps to mitigate risks. The skill not only flags potential issues but also provides a structured JSON report that includes severity scores and remediation guidance, making it easier to prioritize and address security concerns.
The analysis process begins by downloading IAM authorization details, which include all users, groups, roles, and policies in the AWS account. Each policy is then evaluated for known escalation permission combinations, and any wildcard resource policies that expose sensitive actions are flagged. Additionally, the skill maps the relationships between principals and policies, allowing users to visualize potential escalation paths. This comprehensive approach ensures that users can effectively manage and secure their AWS environments against privilege escalation threats.
When to use it
Use this skill when investigating security incidents or when building detection rules for AWS IAM privilege escalation.
When not to use it
This skill may not be suitable for environments without AWS IAM or for users without necessary permissions to access IAM details.
What you can build with it
Investigating Security Incidents
Use this skill to detect potential privilege escalation paths during security investigations.
Building Detection Rules
Integrate this skill into your threat hunting queries to enhance AWS IAM monitoring.
Validating Security Coverage
Employ this skill to ensure your AWS security monitoring effectively covers privilege escalation techniques.
How to install Detecting AWS IAM Privilege Escalation
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-aws-iam-privilege-escalation --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting AWS IAM Privilege Escalation
Overview
This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.
When to Use
- When investigating security incidents that require detecting aws iam privilege escalation
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Python 3.8+ with boto3 library
- AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
- Optional: cloudsplaining Python package for HTML report generation
Steps
- Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
- Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
- Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
- Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
- Score and Prioritize Findings — Rank findings by severity based on escalation vector type
- Generate Report — Produce structured JSON report with remediation guidance
Expected Output
- JSON report of privilege escalation findings with severity scores
- List of dangerous permission combinations per principal
- Wildcard resource policy audit results
- Remediation recommendations for each finding
Frequently asked questions about Detecting AWS IAM Privilege Escalation
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.