0PricingLogin▼
Cyber Security Academy · Lesson

Exploiting IAM Misconfigurations

Privilege escalation in the cloud.

IAM as an Escalation Engine

In the cloud, privilege escalation usually means abusing IAM permissions rather than exploiting memory bugs. If a low-priv identity can modify policies, create keys, or assume roles, it can reach admin.

  • Permissions that modify IAM are inherently dangerous.
  • Escalation paths are policy logic, not vulnerabilities.
  • The fix is least privilege, not a patch.

Dangerous Permissions

Certain IAM actions enable direct escalation. Watch for these on a principal you control:

  • iam:CreateAccessKey on another user.
  • iam:AttachUserPolicy / iam:PutUserPolicy (attach AdministratorAccess).
  • iam:CreatePolicyVersion (rewrite an existing policy).
  • iam:PassRole + a compute service (run code as a privileged role).
  • sts:AssumeRole with a weak trust policy.

All lessons in this course

  1. Cloud Attack Surface
  2. Enumerating Cloud Resources
  3. Exploiting IAM Misconfigurations
  4. Persistence and Lateral Movement
← Back to Cyber Security Academy