- Direct IAM Policy Manipulation (Paths 1-7)
- Credential Theft & Account Takeover (Paths 8-10)
- PassRole + Service Exploitation (Paths 11-22)
- Permission Boundary Attacks (Paths 23-28)
- Lambda-Specific Escalation (Paths 29-31)
- Trust Policy Manipulation (Paths 32-35)
- New 2024-2026 Vectors (Paths 36-48)
- Dangerous Permission Combinations
- Cross-Service Attack Chains
- S3 Misconfiguration Taxonomy
- IMDS Exploitation
Path 1: iam:CreatePolicyVersion — Create new version with Action:*,Resource:*, set as default. Full admin.
Path 2: iam:SetDefaultPolicyVersion — Revert to a previous more-permissive policy version.
Path 3: iam:AttachUserPolicy / AttachGroupPolicy / AttachRolePolicy — Attach AdministratorAccess to self/group/role.
Path 4: iam:PutUserPolicy / PutGroupPolicy / PutRolePolicy — Create inline policy with arbitrary permissions.
Path 5: iam:AddUserToGroup — Add self to an admin group.
Path 6: iam:CreatePolicy + iam:AttachUserPolicy — Create a new admin policy and attach it.
Path 7: iam:TagRole/TagUser + ABAC bypass — If policies use tag-based conditions, modify tags to match allowed conditions.
Path 8: iam:CreateAccessKey (on other users) — Generate access keys for a more-privileged user.
Path 9: iam:CreateLoginProfile — Create console password for a user lacking one.
Path 10: iam:UpdateLoginProfile — Reset existing user's console password.
PassRole is the single most exploited permission in AWS. Combined with service creation:
Common preconditions for ALL PassRole paths (11-22):
- Requires:
iam:PassRoleon the specific target role (not just any role). Check theResourcefield —*means any role, specific ARN means only that role. - Blocked if: (1) Permission boundary on the calling principal excludes PassRole or the target service action. (2) SCP denies
iam:PassRoleor the service action. (3) PassRole condition keyiam:PassedToServicerestricts which services. (4) Target role's trust policy doesn't trust the service being used. - Assumptions: No permission boundary. No SCP restricting PassRole. Target role trusts the relevant service.
Path 11: PassRole + lambda:CreateFunction + lambda:InvokeFunction — Create Lambda with admin role, invoke for arbitrary API execution.
Path 12: PassRole + ec2:RunInstances — Launch EC2 with admin instance profile, access role creds via IMDS.
Path 13: PassRole + cloudformation:CreateStack — Deploy stack with admin service role → stack creates arbitrary resources.
Path 14: PassRole + glue:CreateDevEndpoint — Create Glue dev endpoint with admin role, SSH in for credentials.
Path 15: PassRole + ecs:RegisterTaskDefinition + ecs:RunTask — Run ECS task with admin task role.
Path 16: PassRole + sagemaker:CreateNotebookInstance — Notebook with admin role, open Jupyter for credential access.
Path 17: PassRole + datapipeline:CreatePipeline + PutPipelineDefinition + ActivatePipeline — Pipeline with elevated role.
Path 18: PassRole + codebuild:CreateProject — Build project with admin service role.
Path 19: PassRole + codestar:CreateProject — CodeStar project inheriting privileged role.
Path 20: PassRole + glue:CreateJob / glue:UpdateJob — Glue ETL jobs with elevated roles.
Path 21: PassRole + autoscaling:CreateLaunchConfiguration + CreateAutoScalingGroup — ASG instances with admin profiles.
Path 22: PassRole + ec2:RequestSpotInstances — Spot instances with elevated instance profiles.
These REMOVE restrictions rather than adding permissions — equally dangerous:
Path 23: iam:DeleteRolePermissionsBoundary — Remove boundary that constrains a role.
Path 24: iam:DeleteUserPermissionsBoundary — Remove boundary constraining a user.
Path 25: iam:PutRolePermissionsBoundary — Replace restrictive boundary with permissive one.
Path 26: iam:PutUserPermissionsBoundary — Same for users.
Path 27: iam:DeleteRolePolicy / DeleteUserPolicy — Delete explicit deny policies.
Path 28: iam:DetachRolePolicy / DetachUserPolicy — Detach managed deny policies.
Path 29: lambda:UpdateFunctionCode — Replace code of Lambda with privileged role → execute as that role.
Path 30: lambda:UpdateFunctionConfiguration — Add malicious Layer to existing function.
Path 31: lambda:AddPermission — Modify resource-based policy for cross-account invocation.
Common preconditions for trust policy paths (32-35):
- Requires:
iam:UpdateAssumeRolePolicyon the specific target role. - Blocked if: (1) SCP denies
iam:UpdateAssumeRolePolicy. (2) Permission boundary excludes it. (3) Role is a service-linked role (trust policy immutable). - Assumptions: Target role is customer-managed, not service-linked.
Path 32: iam:UpdateAssumeRolePolicy — Modify privileged role's trust to allow self to assume it.
Path 33: sts:AssumeRole chaining — Role A → Role B → Role C, cumulative permissions.
Path 34: Cross-account wildcard trust — "Principal": {"AWS": "*"} without conditions.
Path 35: Confused Deputy — Trust policy trusts service without sts:ExternalId or source conditions.
Path 36: Bedrock AgentCore (2025) — iam:PassRole + bedrock-agentcore:CreateCodeInterpreter + InvokeCodeInterpreter. Create AI code interpreter with privileged role for arbitrary code execution. First AI-era privesc vector.
Path 37: Misconfigured OIDC Federation (2024-2025) — GitHub Actions/GitLab CI trust policies lacking sub claim validation. Any GitHub repo assumes target role when only aud is checked. Tool: oidc-scanner-aws (Tinder Security Labs).
Path 38: CVE-2024-28056 (Amplify) — Same-account exploitation of Amplify's Cognito configuration for overpermissioned role assumption.
Path 39: SageMaker Presigned Notebook URLs — sagemaker:CreatePresignedNotebookInstanceUrl grants Jupyter access with full SageMaker execution role permissions.
Path 40: ECScape - ECS Cross-Task Credential Theft (Black Hat 2025) — Compromised container queries IMDS for EC2 role creds, discovers ACS endpoint via ecs:DiscoverPollEndpoint, impersonates ECS agent via WebSocket to steal credentials for ANY other task on same host. CloudTrail attributes stolen calls to victim task role.
Path 41: EKS Pod Identity Credential Interception (Wiz, 2025) — Pod Identity Agent exchanges JWT for IAM creds over unencrypted HTTP. Containers with hostNetwork: true sniff credentials of other pods.
Path 42: CodeBuild Supply Chain — "CodeBreach" (Wiz, 2025-2026) — Unanchored regex in ACTOR_ID webhook filter allowed unauthenticated PR trigger → leaked GitHub admin tokens → full takeover of aws-sdk-js-v3 (powers AWS Console). Disclosed Aug 25, 2025 → AWS patched within 48h → additional hardening Sep 2025 → public disclosure Jan 15, 2026. Dubbed "bigger than SolarWinds" potential.
Path 43: GitLab OIDC Misconfiguration (AWS Console Default-Vulnerable) — When creating IAM roles via AWS Console with GitLab as Web Identity provider, the console generates a trust policy WITHOUT sub condition. Unlike GitHub Actions and Terraform Cloud (where AWS added mandatory fields), GitLab OIDC roles are vulnerable by default via the AWS Console. Any GitLab project can assume the role. RCPs can mitigate. Documented by Nick Frichette, HackingThe.Cloud.
Path 44: Terraform Cloud OIDC Misconfiguration — Same pattern as GitLab. Trust policy with only aud check → any Terraform Cloud workspace can assume the role. Attacker creates a Terraform workspace in their own org, generates JWT, calls sts:AssumeRoleWithWebIdentity. Can then deploy resources (including backdoor IAM roles) in victim account.
Path 45: whoAMI — AMI Name Confusion Attack (fwd:cloudsec 2025) — Attacker publishes AMI with a name matching internal naming convention → victim's automation (Terraform, launch templates) pulls attacker's AMI instead of legitimate one → EC2 launches with attacker-controlled OS → full code execution with instance role.
Path 46: Public Resource Exploitation Playbook (HackingThe.Cloud) — Multiple AWS resources can be misconfigured to be publicly accessible and exploited programmatically:
- Public RDS Snapshots:
rds:DescribeDBSnapshots --include-public→ restore to attacker account → full database access - Public AMIs: Search by account ID → launch in attacker account → extract secrets from filesystem
- Public EBS Snapshots:
ec2:DescribeSnapshots --restorable-by-user-ids all→ copy + mount → extract data - Public ECR Repositories: Pull container images → analyze for secrets, backdoor
- Public Lambda Layers: Discover + analyze shared layers for credential exposure
Path 47: Cognito User Pool Self-Signup Abuse — If Cognito User Pool doesn't enforce Admin-only signup, attacker can sign up using just the Client ID (extractable from frontend source code). New account → authenticated identity pool access → potentially exchange for AWS IAM credentials via Cognito Identity Pool. Combined with CVE-2024-28056 (Amplify) for role assumption.
Path 48: IAM Roles Anywhere Persistence (Stratus Red Team, Sept 2025) — Attacker generates own CA certificate → registers as Trust Anchor in victim account (rolesanywhere:CreateTrustAnchor) → creates Profile linking to target IAM roles → signs client certificates with attacker CA → generates on-demand temporary AWS credentials from OUTSIDE AWS. Persists through key rotation, doesn't require existing credentials after setup. Detectable via CreateTrustAnchor in CloudTrail.
Common preconditions for Organizations paths (49-52):
- Requires: Management account access OR delegated administrator for the specific service. Member accounts CANNOT perform these actions.
- Blocked if: (1) Attacker is in a member account (Org APIs only work from management account). (2)
organizations:*actions restricted by SCP on the management account. - Assumptions: Attacker has compromised a principal in the management account. If the input shows member account context, these paths are NOT applicable.
Path 49: organizations:CreateAccount — Create a new AWS account within the org. Attacker becomes root of the new account. New account inherits org's SCPs but attacker has full admin within. Use as staging/pivot point or to generate credentials outside monitoring scope. The management account's CloudTrail may not monitor new member account activity by default.
Path 50: SCP Manipulation — organizations:CreatePolicy + organizations:AttachPolicy — Modify or
replace Service Control Policies to remove security guardrails org-wide. Detach deny-list SCPs from
OUs → member accounts regain restricted permissions. Attach permissive SCPs → override security
baselines. Combined with organizations:UpdatePolicy to silently weaken existing SCPs.
Path 51: Delegated Administrator Abuse — organizations:RegisterDelegatedAdministrator — Register attacker-controlled member account as delegated admin for services (SecurityHub, GuardDuty, Config, CloudFormation StackSets). Delegated admin can push configurations org-wide, disable security findings, or deploy resources across all member accounts via StackSets.
Path 52: organizations:InviteAccountToOrganization — Invite external attacker-controlled account
into org. Account gains access to shared resources (RAM shares, VPC peering, org-level roles).
Combined with organizations:MoveAccount to place invited account in permissive OU with weak SCPs.
Common preconditions for SSO paths (53-55):
- Requires: IAM Identity Center instance must exist in the account/org. SSO permissions (
sso:*,sso-directory:*) on the calling principal. - Blocked if: (1) SCP denies SSO actions. (2) Identity Center uses external IdP (not built-in directory) — Path 55 (directory user creation) doesn't apply. (3) Permission set maximum session duration limits blast window.
- Assumptions: Identity Center is deployed and the calling principal has SSO permissions.
Path 53: sso:CreatePermissionSet + sso:AttachManagedPolicyToPermissionSet — Create a new SSO
permission set with AdministratorAccess (or custom inline policy), then assign it to any account.
This is the modern equivalent of iam:CreateUser + iam:AttachUserPolicy for SSO-based orgs.
Most enterprise AWS environments use SSO as primary access method — compromising the Identity Center
instance = compromising all member accounts.
Path 54: sso:CreateAccountAssignment — Assign any user/group to any AWS account with any permission set. Attack: create backdoor SSO user → assign AdministratorAccess to target accounts → access any account via SSO portal. Bypasses per-account IAM controls entirely.
Path 55: sso-directory:CreateUser + sso:CreateAccountAssignment — If using Identity Center's
built-in directory (not external IdP), create a new user and assign it to accounts. The user
appears as a legitimate SSO identity. Combined with identitystore:CreateGroupMembership to add
existing backdoor user to privileged groups.
Common preconditions for Bedrock paths (56-58):
- Requires: Bedrock must be enabled in the account/region. Model access is opt-in per model.
- Blocked if: (1) Bedrock not enabled. (2) SCP restricts
bedrock:*actions. (3) VPC endpoint policy limits Bedrock access. (4) Guardrails configured (Path 58 specifically targets guardrail bypass). - Assumptions: Bedrock is enabled with at least one model accessible.
Path 56: Bedrock Knowledge Base Data Poisoning — bedrock:UpdateDataSource or s3:PutObject
on Knowledge Base source bucket → inject adversarial documents → RAG pipeline returns attacker-
controlled content to all users querying the knowledge base. No model retraining needed — data
source update triggers automatic re-indexing. Enables: misinformation injection, prompt injection
via retrieved documents, credential harvesting via crafted responses.
Path 57: Bedrock Model Access Control Bypass — bedrock:InvokeModel without
bedrock:GetFoundationModelAgreement → invoke models the account has access to. Combined with
bedrock:CreateModelCustomizationJob → fine-tune foundation models with malicious training data →
model produces attacker-desired outputs. bedrock:GetModelInvocationLoggingConfiguration reveals
whether model invocations are being logged.
Path 58: Bedrock Agent Prompt Injection — bedrock:InvokeAgent with crafted input that
bypasses guardrails → agent executes attacker instructions against connected data sources (S3,
knowledge bases, Lambda functions). If agent has Lambda action groups with broad permissions →
indirect code execution. Guardrail bypass techniques: encoding, multi-turn context manipulation,
instruction hierarchy exploitation.
RCPs are the resource-based complement to SCPs. Where SCPs restrict principal actions, RCPs restrict resource-level access (e.g., "no external access to any S3 bucket in this org"). Key analysis points:
organizations:CreatePolicy(type: RESOURCE_CONTROL_POLICY) → create/modify RCPs- RCPs can prevent cross-account resource sharing, external principal access, and public resource exposure
- If RCPs are NOT deployed → no resource-level guardrails exist
- Management account is EXEMPT from RCPs (same as SCPs) — compromise management account = bypass all policies
| Combination | Risk | Attack Vector |
|---|---|---|
s3:GetObject + iam:PassRole |
HIGH | Read secrets from S3, use PassRole to escalate |
ec2:DescribeInstances + ssm:SendCommand |
HIGH | Enumerate targets, execute commands as root |
lambda:UpdateFunctionCode + lambda:InvokeFunction |
CRITICAL | Arbitrary code exec with Lambda's role |
iam:CreateUser + iam:AttachUserPolicy |
CRITICAL | Create admin backdoor user |
sts:AssumeRole + iam:UpdateAssumeRolePolicy |
CRITICAL | Modify trust, assume any role |
s3:PutObject on CodePipeline source bucket |
HIGH | Inject code into deployment pipeline |
ecr:PutImage + ECS auto-deploy |
CRITICAL | Supply chain via container image |
secretsmanager:GetSecretValue + broad scope |
HIGH | Credential harvesting |
kms:Decrypt + s3:GetObject (encrypted buckets) |
HIGH | Access encrypted data |
logs:CreateExportTask + s3:GetObject |
MEDIUM | Exfiltrate CloudWatch logs |
iam:CreateServiceLinkedRole + service abuse |
MEDIUM | Create roles that bypass normal IAM controls |
organizations:LeaveOrganization |
CRITICAL | Strip SCPs, remove centralized controls |
ec2:ModifySnapshotAttribute + external account |
HIGH | Exfil entire disk volumes |
lambda:AddLayerVersionPermission |
HIGH | Share malicious layer cross-account |
s3:PutBucketPolicy on CloudTrail bucket |
CRITICAL | Modify access → log tampering/deletion |
Accessible S3 bucket → contains Lambda deployment package → attacker uploads modified code → Lambda deploys → executes attacker code with function role.
EC2 with SSRF (IMDSv1) → 169.254.169.254 → instance role creds → secretsmanager:GetSecretValue → database credentials → full data access. This is the Capital One breach pattern (106M customers).
cloudformation:* + iam:PassRole → create stack with admin role → stack creates new admin user + access keys → exfiltrate to attacker S3 → persistent admin access.
SSM parameters with DB connection strings → Lambda reads at runtime → env vars visible via lambda:GetFunction → attacker reads env → connects to DB directly.
Third-party config vars contain AWS keys → keys have broad S3/IAM perms → compromise third-party → read config → use AWS creds → Secrets Manager → cascading access.
Misconfigured OIDC trust (no sub check) → any GitHub repo assumes role → role has cross-account trust → pivot to production account → data access.
Push backdoored container image to ECR → ECS/EKS pulls on deploy → container executes with task/pod role + node role via IMDS → cloud plane access.
codebuild:StartBuild or modified buildspec → inject into build output → downstream services consume poisoned artifact → supply chain compromise.
EventBridge rule targeting specific API calls → trigger Lambda with broad permissions → persistent monitoring + automated response to attacker-defined events.
events:PutRule + events:PutTargets → create rules that trigger on specific CloudTrail events.
Attacker creates rule: "when DeleteAccessKey is called for my backdoor key, immediately create
a new key via Lambda." Self-healing persistence — every time defender removes the key, a new one
appears automatically. Also useful for: re-creating deleted IAM users, re-attaching removed policies,
re-enabling disabled trails.
events:PutPermission → allow external AWS account to send events to your bus. Reverse:
events:CreateEventBus with resource policy allowing attacker account → siphon events to external
account. Cross-account event buses can be used for:
- Data exfiltration: Forward CloudTrail events (containing API call details) to attacker account
- Lateral movement: Attacker sends crafted events → trigger Lambda in victim account
- Persistence: Event bus permission survives IAM cleanup if not specifically audited
scheduler:CreateSchedule → create cron-based or rate-based triggers executing Lambda/StepFunctions/
ECS tasks with a specified IAM role. Attack: create schedule with 1-minute interval → Lambda mints
new credentials → exfiltrates to attacker. Schedules are often overlooked during incident response
because they're separate from EventBridge Rules in the console. scheduler:GetSchedule for recon.
pipes:CreatePipe → connect event sources (SQS, DynamoDB Streams, Kinesis, Kafka) directly to
targets (Lambda, StepFunctions, API destinations). Attack: create pipe on DynamoDB Stream → every
database change forwarded to attacker-controlled HTTPS endpoint. Real-time data exfiltration that
bypasses application-level monitoring.
EventBridge rule creation appears as PutRule in CloudTrail. Scheduler as CreateSchedule.
Pipes as CreatePipe. But: defenders must specifically monitor these API calls — they're not in
default GuardDuty findings. Most SOC playbooks don't include EventBridge in their IAM cleanup
procedures, making it an effective persistence mechanism.
- Public Anonymous —
"Principal": "*"with no conditions → anyone on internet - Authenticated AWS Users —
"Principal": {"AWS": "*"}→ any AWS account globally - Cross-Account Explicit — Specific account ID → intended but verify authorization
- Same-Account Broad —
"Principal": {"AWS": "arn:aws:iam::SELF:root"}→ any identity in account - Specific Principal — Scoped to specific role/user → evaluate that principal's trust
s3:PutBucketPolicy→ attacker rewrites policy for full accesss3:PutBucketAcl→ same via ACLs3:PutObjecton code/deployment buckets → code injections3:PutReplicationConfiguration→ silent data exfil to attacker buckets3:PutLifecycleConfiguration→ schedule data deletion (ransomware)s3:DeleteObject/s3:DeleteBucket→ data destruction
ACLs and Policies are evaluated independently. Restrictive policy can be overridden by permissive ACL. AuthenticatedUsers in ACL = globally authenticated, not your account. AllUsers = anonymous. Always check BOTH.
- v1: Simple GET to
http://169.254.169.254/latest/meta-data/→ SSRF exploitable. Enabled the Capital One breach. - v2: Requires PUT to get session token with TTL, then GET with token header → blocks most SSRF. Default for new instances since November 2023.
- Check:
HttpTokens=optional→ v1 still available (critical).HttpTokens=required→ v2 only (secure).
/latest/meta-data/iam/security-credentials/<ROLE>→ full temporary AWS credentials/latest/user-data→ often contains bootstrap secrets, keys, passwords/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance/→ EC2 instance identity
Full-control SSRF (arbitrary HTTP methods + headers) can still defeat IMDSv2. DNS rebinding attacks in some configurations. Container escapes from EKS/ECS may reach IMDS.
- F5 Labs detected a 4-day campaign (March 2025) targeting IMDS via SSRF params (url, dest, file, redirect)
- Wiz documented IMDS anomaly hunting techniques for zero-day discovery
- Any internet-facing EC2 without IMDSv2 enforcement → CRITICAL finding
- AWS Offensive Tools
- Azure Offensive Tools
- Cross-Platform & Specialized
- Defensive & Auditing Tools
- Knowledge Bases & Awesome Lists
- Vulnerable-by-Design Labs
| Tool | Developer | Purpose | URL |
|---|---|---|---|
| Pacu | Rhino Security Labs | Full AWS exploitation framework, modular architecture | github.com/RhinoSecurityLabs/pacu |
| Stratus Red Team | Datadog | Cloud adversary emulation, 37+ AWS MITRE techniques | github.com/DataDog/stratus-red-team |
| CloudFox | Bishop Fox | Situational awareness automation for cloud pentests | github.com/BishopFox/cloudfox |
| PMapper | NCC Group | IAM graph-based privilege escalation path analysis | github.com/nccgroup/PMapper |
| enumerate-iam | Andres Riancho | Brute-force IAM permission enumeration | github.com/andresriancho/enumerate-iam |
| Cloudsplaining | Salesforce | IAM security assessment and risk prioritization | github.com/salesforce/cloudsplaining |
| ScoutSuite | NCC Group | Multi-cloud security auditing | github.com/nccgroup/ScoutSuite |
| Prowler | Toni de la Fuente | 240+ security controls, CIS/NIST/PCI compliance | github.com/prowler-cloud/prowler |
| AWSDoor | RiskInsight/Wavestone | Automated persistence, evasion, exfiltration | Presented at security conferences |
| SneakyEndpoints | Nick Frichette | GuardDuty credential exfiltration bypass (declining reliability) | github.com/Frichetten/SneakyEndpoints |
| pathfinding.cloud | Datadog | YAML-structured IAM privesc path library | github.com/DataDog/pathfinding.cloud |
| SkyArk / AWStealth | CyberArk | Shadow admin discovery | github.com/cyberark/SkyArk |
| Dufflebag | BishopFox | Find secrets in public EBS snapshots | github.com/BishopFox/dufflebag |
| Barq | Open source | Post-exploitation for EC2 without SSH keys | github.com/Voulnet/barq |
| CloudMapper | Duo Labs | Network visualization + security analysis | github.com/duo-labs/cloudmapper |
| Cartography | Lyft | Infrastructure graph in Neo4j | github.com/lyft/cartography |
| weirdAAL | carnal0wnage | AWS attack library | github.com/carnal0wnage/weirdAAL |
| oidc-scanner-aws | Tinder Security Labs | OIDC trust policy validation (black-box) | Released via Tinder Tech Blog |
| CloudCopy | Static-Flow | Shadow Copy attack on domain controllers in AWS | github.com/Static-Flow/CloudCopy |
| Tool | Developer | Purpose | URL |
|---|---|---|---|
| ROADtools | Dirk-jan Mollema | Entra ID enum, PRT forging, device registration | github.com/dirkjanm/ROADtools |
| AADInternals | Nestori Syynimaa | Token manipulation, federation backdoors, PTA abuse | github.com/Gerenios/AADInternals |
| AzureHound | SpecterOps | Azure AD data collection for BloodHound | github.com/BloodHoundAD/AzureHound |
| MicroBurst | NetSPI (Fosaaen) | Azure service discovery, cred dumping, blob enum | github.com/NetSPI/MicroBurst |
| PowerZure | SpecterOps | Azure recon and exploitation framework | github.com/hausec/PowerZure |
| GraphRunner | Beau Bullock | Post-exploitation via Microsoft Graph API | github.com/dafthack/GraphRunner |
| TokenTactics / V2 | Steve Borosh | Device code phishing, token refresh, CA bypass | github.com/rvrsh3ll/TokenTactics |
| TeamFiltration | TrustedSec | O365/Entra ID enum, spraying, exfiltration | github.com/Flangvik/TeamFiltration |
| Monkey365 | silverhack | M365/Azure/Entra ID security config review | github.com/silverhack/monkey365 |
| CloudPEASS | Carlos Polop | Permission enum and privesc path ID | github.com/carlospolop/privilege-escalation-awesome-scripts-suite |
| Stormspotter | Azure (archived) | Azure AD + ARM visualization | github.com/Azure/Stormspotter |
| ScubaGear | CISA | M365 security configuration assessment | github.com/cisagov/ScubaGear |
| Tool | Developer | Purpose | URL |
|---|---|---|---|
| GCPBucketBrute | Rhino Security | GCS bucket enum, access check, privesc | github.com/RhinoSecurityLabs/GCPBucketBrute |
| GCP-IAM-Privilege-Escalation | Rhino Security | Privesc scanner + exploit scripts | github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation |
| gcpwn | NetSPI | Comprehensive GCP pentest framework (Pacu equivalent); brute-forces ~9500 perms | github.com/NetSPI/gcpwn |
| gcploit | Dylan Ayrey | BFS privesc scanner + exploit framework (DEF CON 28) | github.com/dxa4481/gcploit |
| DeleFriend | Hunters Team Axon | DWD enumeration and exploitation | github.com/axon-git/DeleFriend |
| Patchy | rek7 | Lateral movement via GCP OS Patch Management | github.com/rek7/patchy |
| PurplePanda | Carlos Polop | Cross-cloud privesc path analysis via Neo4j | github.com/carlospolop/PurplePanda |
| gcp_scanner | Google (unofficial) | Credential impact assessment scanner | github.com/google/gcp_scanner |
| GCPHound | desi-jarvis | Offensive recon toolkit for GCP | github.com/desi-jarvis/GCPHound |
| gcp_enum | GitLab Red Team | GCP environment enumeration | gitlab.com/...redteam-public/gcp_enum |
| gcp_firewall_enum | GitLab Red Team | Compute firewall enum → targeted scans | gitlab.com/...redteam-public/gcp_firewall_enum |
| gcp_k8s_enum | GitLab Red Team | GKE service exposure enumeration | gitlab.com/...redteam-public/gcp_k8s_enum |
| gcp_misc | GitLab Red Team | Misc GCP attack operations | gitlab.com/...redteam-public/gcp_misc |
| Token Hunter | GitLab | Find sensitive data in GCS buckets | gitlab.com/...redteam-public/token-hunter |
| Hayat | Deniz Parlak | GCP audit + hardening script | github.com/DenizParlak/hayat |
| Forseti Security | Google (archived) | GCP inventory monitoring + policy | github.com/forseti-security/forseti-security |
| Tool | Purpose | URL |
|---|---|---|
| COBRA (Palo Alto) | Multi-cloud breach and risk assessment | github.com/paloaltonetworks/cobra |
| Halberd | Attack execution: Entra ID, M365, Azure, AWS | github.com/vectra-ai-research/Halberd |
| Cloud Katana (Microsoft) | Serverless attack simulation | github.com/Azure/Cloud-Katana |
| peirates (InGuardians) | Kubernetes penetration testing | github.com/inguardians/peirates |
| kubesploit | Cross-platform container post-exploitation | github.com/cyberark/kubesploit |
| CDK | Zero-dependency container pentest toolkit | github.com/cdk-team/CDK |
| SubOver (Ice3man543) | Subdomain takeover detection | github.com/Ice3man543/SubOver |
| Nuclei (ProjectDiscovery) | Template-based vulnerability scanner incl. cloud | github.com/projectdiscovery/nuclei |
| CloudBrute | Cloud infrastructure enum across providers | github.com/0xsha/CloudBrute |
| cloud_enum | Multi-cloud resource enumeration | github.com/initstring/cloud_enum |
| TruffleHog | Secret detection in git repos and more | github.com/trufflesecurity/trufflehog |
| GitLeaks | Git repo secret auditing | github.com/gitleaks/gitleaks |
| Tool | Purpose | URL |
|---|---|---|
| Prowler | AWS/Azure/GCP CIS benchmark scanning | github.com/prowler-cloud/prowler |
| ScoutSuite | Multi-cloud security auditing | github.com/nccgroup/ScoutSuite |
| CloudSploit | AWS security scanning | github.com/aquasecurity/cloudsploit |
| Steampipe | SQL-based cloud security queries | github.com/turbot/steampipe |
| CloudQuery | Cloud asset inventory and compliance | github.com/cloudquery/cloudquery |
| Checkov | IaC static analysis (Terraform, CFN, K8s) | github.com/bridgecrewio/checkov |
| tfsec | Terraform security scanner | github.com/aquasecurity/tfsec |
| cfn_nag | CloudFormation security lint | github.com/stelligent/cfn_nag |
| Terrascan | IaC security scanning | github.com/tenable/terrascan |
| Repokid (Netflix) | IAM least-privilege enforcement | github.com/Netflix/repokid |
| CloudCustodian (Capital One) | Cloud governance rules engine | github.com/cloud-custodian/cloud-custodian |
| Hammer (Dow Jones) | AWS security automation | github.com/dowjones/hammer |
- HackTricks Cloud — cloud.hacktricks.xyz — Comprehensive cloud/SaaS hacking encyclopedia (Carlos Polop)
- Hacking the Cloud — hackingthe.cloud — Offensive/defensive cloud security encyclopedia (Nick Frichette)
- Azure Threat Research Matrix — microsoft.github.io/Azure-Threat-Research-Matrix — Microsoft's official attack taxonomy
- Cloud-Architekt/AzureAD-Attack-Defense — Thomas Naunheim's Entra ID attack/defense playbook
- PayloadsAllTheThings — swisskyrepo.github.io — Cloud pentesting cheatsheets
- lutzenfried/OffensiveCloud — Offensive TTP collection for AWS/Azure/GCP
- Stratus Red Team Docs — stratus-red-team.cloud — Attack technique catalog with detection guidance
- Kyuu-Ji/Awesome-Azure-Pentest — 1.2k stars, definitive Azure pentest resource
- kmcquade/awesome-azure-security — Curated Azure security tools and guides
- jassics/awesome-aws-security — AWS security links, exploits, CTFs
- toniblyx/my-arsenal-of-aws-security-tools — Massive offensive/defensive/DFIR collection
- 4ndersonLin/awesome-cloud-security — Multi-cloud security resources
- RyanJarv/awesome-cloud-sec — Cloud security projects (AWS offensive focus)
- donnemartin/awesome-aws — Most popular general AWS awesome list
- Littlehack3r/awesome-gcp-pentesting — GCP offensive security tools and resources
- senaykt/cloud-security-resources — Multi-cloud security resource collection
- Rhino Security Labs (rhinosecuritylabs.com)
- Wiz Research (wiz.io/blog)
- Datadog Security Labs (securitylabs.datadoghq.com)
- SpecterOps (specterops.io/blog)
- NetSPI (netspi.com/blog)
- Bishop Fox (bishopfox.com/blog)
- Unit 42 / Palo Alto Networks (unit42.paloaltonetworks.com)
- Praetorian (praetorian.com/blog)
- Dirk-jan Mollema (dirkjanm.io)
- Semperis (semperis.com/blog)
- Mitiga (mitiga.io/blog)
| Lab | Focus | URL |
|---|---|---|
| CloudGoat (Rhino Security) | CTF-style AWS/Azure attack scenarios | github.com/RhinoSecurityLabs/cloudgoat |
| IAM Vulnerable (Bishop Fox) | 31 IAM privilege escalation pathways | github.com/BishopFox/iam-vulnerable |
| CloudFoxable (Bishop Fox) | CTF-format AWS environment for CloudFox | github.com/BishopFox/cloudfoxable |
| flAWS.cloud (Scott Piper) | Progressive AWS security challenges | flaws.cloud / flaws2.cloud |
| AzureGoat / AWSGoat (INE) | OWASP Top 10 + cloud misconfigs | github.com/ine-labs/AzureGoat |
| EntraGoat / BadZure | Deliberately vulnerable Entra ID | github.com/Kyuu-Ji/BadZure |
| Sadcloud (NCC Group) | 84 misconfigs across 22 AWS services | github.com/nccgroup/sadcloud |
| ServerlessGoat (OWASP) | Deliberately insecure Lambda app | github.com/OWASP/Serverless-Goat |
| EKS Cluster Games (Wiz) | Kubernetes security CTF | eksclustergames.com |
| K8s Lan Party (Wiz) | K8s network security CTF | Available via Wiz |
| GCP Goat (INE Labs) | Vulnerable by design GCP infrastructure | github.com/ine-labs/GCPGoat |
| Thunder CTF (Google) | GCP-focused security CTF | thunder-ctf.cloud |
| Pwned Labs | Free hosted cloud security labs | pwnedlabs.io |
| DVCA | Damn Vulnerable Cloud Application | github.com/m6a-UdS/dvca |
| AWSDetonationLab | AWS security service detection testing | github.com/sonofagl1tch/AWSDetonationLab |
- 154% year-over-year surge in significant cloud breaches
- 5x increase in daily cloud security alerts (Unit 42)
- Average US breach cost: $10.22M
- 34% of organizations with AI workloads experienced AI-related breaches (CSA)
- AI-driven phishing projected to exceed 42% of global intrusions by end of 2026
- Supply chain attacks >50% of Wiz's most-read investigations in 2025
- IngressNightmare (CVE-2025-1974) affected 48% of cloud environments
Individual misconfigurations are often low/medium risk. The real danger emerges when they combine. After identifying all individual findings, run every finding pair and triple through this matrix.
| Combo | Individual Risk | Combined Risk | Result |
|---|---|---|---|
iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction |
Medium each | CRITICAL | Create Lambda with target role → execute as that role (severity = role's permissions; blocked if permission boundary or SCP restricts PassRole target) |
| Public S3 + Terraform state / .env files in bucket | Medium + Low | CRITICAL | Anon reads → plaintext creds in state → account takeover |
sts:AssumeRole wildcard trust + no ExternalId |
Medium + Low | HIGH | Any AWS account can assume the role |
| IMDS v1 + broad IAM role + internet-facing EC2 | Medium each | CRITICAL | SSRF → cred theft → blast radius of role perms (Capital One pattern) |
s3:PutObject on web bucket + no CloudTrail Data Events |
Medium + Medium | HIGH | Silent website defacement / cryptominer injection |
iam:CreateAccessKey + iam:ListUsers |
Medium + Low | CRITICAL | Enumerate all users → mint keys for any of them |
ecr:PutImage + ECS auto-deploy |
Medium + Low | CRITICAL | Supply chain via container image poisoning |
events:PutRule + lambda:InvokeFunction |
Medium + Medium | HIGH | Self-healing persistence: key deleted → EventBridge recreates via Lambda |
sso:CreatePermissionSet + sso:CreateAccountAssignment |
Medium + Medium | CRITICAL | SSO backdoor → admin access to any account |
organizations:CreatePolicy + organizations:AttachPolicy |
Medium + Medium | CRITICAL | SCP manipulation → strip security guardrails org-wide |
| Combo | Individual Risk | Combined Risk | Result |
|---|---|---|---|
| Application.ReadWrite.All + app with Directory role | Medium + Medium | CRITICAL | Add creds to privileged SP → Global Admin |
| Managed Identity + cross-service attachment | Medium + Low | HIGH | Compromise one service → pivot via shared MI |
| Contributor + Automation Account with RunAs | Medium + Medium | CRITICAL | Deploy runbook → execute as RunAs SP → escalate |
| PIM eligible assignment + no approval gate | Medium + Low | CRITICAL | Self-activate → instant privileged access without oversight |
| Conditional Access gap + stolen PRT | Medium + Medium | CRITICAL | Replay PRT from non-compliant device → bypass device compliance CA |
| App Registration + federated credential without subject | Medium + Low | HIGH | Any identity from OIDC provider can authenticate as the app |
| Service Connection (Owner) + ADO pipeline access | Medium + Medium | CRITICAL | Pipeline compromise → full Azure subscription takeover |
| Combo | Individual Risk | Combined Risk | Result |
|---|---|---|---|
iam.serviceAccountKeys.create + DWD-enabled SA |
Medium + Medium | CRITICAL | Mint key → impersonate any Workspace user (DeleFriend) |
compute.admin + SA with broad permissions on VMs |
Medium + Medium | CRITICAL | SSH key injection → all VMs → steal all SA tokens |
storage.admin (allUsers) + logging.admin (allAuthenticatedUsers) |
High + High | EXTINCTION | Blind monitoring → exfil everything undetected |
actAs + cloudfunctions.functions.create |
Medium + Medium | HIGH | Deploy function as privileged SA → token theft |
| Editor role on CI/CD SA + SA key in pipeline config | Medium + Medium | CRITICAL | Pipeline compromise → project-wide access |
cloudfunctions.functions.create + default Cloud Build SA (Jenga) |
Low + Medium | CRITICAL | ConfusedFunction: dependency injection → Editor-equivalent |
composer.environments.update + default Cloud Build SA |
Low + Medium | CRITICAL | ConfusedComposer: PyPI injection → Editor-equivalent |
aiplatform.customJobs.create + default AI Platform SA |
Low + Medium | HIGH | ModeLeak: job runs as overprivileged service agent |
roles/viewer + roles/resourcemanager.tagUser + conditional IAM bindings |
Low + Low + Medium | CRITICAL | Tag-based escalation: satisfy conditions → gain elevated access |
orgpolicy.policy.set + iam.serviceAccountKeys.create |
Medium + Medium | CRITICAL | Disable key creation constraint → mint keys for any SA |
pubsub.subscriptions.create + sensitive topic |
Low + Medium | HIGH | Silent data siphoning from message streams |
| Combo | Individual Risk | Combined Risk | Result |
|---|---|---|---|
| AWS OIDC trust (no sub) + GCP WIF (no condition) + Azure federated cred (no subject) | Medium each | EXTINCTION | Single GitHub/GitLab compromise → all three clouds |
| CI/CD SA with multi-cloud credentials | Medium | CRITICAL | Pipeline compromise = multi-cloud credential harvest |
| Terraform state in public S3/GCS + multi-provider config | Medium + Low | CRITICAL | One state file → credentials for AWS + Azure + GCP |
After listing all individual findings, systematically check: does Finding A + Finding B create a higher-risk combination than either alone? If yes, this combo becomes an Attack Path. A finding that appears in multiple combos is a force multiplier — prioritize its remediation.
Process:
- List all individual findings from the config
- For each finding, scan the relevant provider table above
- Check if any other finding in your list matches the combo partner
- If match found → the combo becomes an Attack Path with the Combined Risk rating
- Findings appearing in 3+ combos = highest remediation priority