☁️ IAM Privilege Escalation

Cloud IAM Privilege Escalation Reference

Every known path from a limited cloud permission to full admin — AWS (25+ paths), Azure, and GCP. For red teams and defenders alike.

These paths are documented for defensive purposes — understanding escalation paths allows defenders to detect and prevent them. Every path includes detection queries and remediation guidance.

☁ AWS IAM Privilege Escalation Paths

Filter:

#1iam:CreatePolicyVersion → Adminiam:CreatePolicyVersionCriticalT1078.004▼

Required Permission(s)

iam:CreatePolicyVersion

Escalation Technique

Create a new version of an existing IAM policy setting it as default. Set the new version to allow Action:* Resource:* — granting full admin access via that policy to all entities attached to it.

Detection

CloudTrail: CreatePolicyVersion where isDefaultVersion=true and policy document contains Action:*

Remediation

SCPs blocking CreatePolicyVersion. Alert on any new policy version creation with wildcard permissions.

#2iam:SetDefaultPolicyVersion → Adminiam:SetDefaultPolicyVersionCriticalT1078.004▼

Required Permission(s)

iam:SetDefaultPolicyVersion

Escalation Technique

If older policy versions with broader permissions exist, set a previous wildcard-permissioned version as default without creating a new one — often overlooked as suspicious.

Detection

CloudTrail: SetDefaultPolicyVersion — especially if version being set is older than current

Remediation

Block SetDefaultPolicyVersion via SCP unless from approved automation role.

#3iam:CreateAccessKey → Lateral Movementiam:CreateAccessKeyCriticalT1552.001▼

Required Permission(s)

iam:CreateAccessKey

Escalation Technique

Create new access keys for any existing IAM user — especially users with higher privileges. Use those keys from external infrastructure.

Detection

CloudTrail: CreateAccessKey where targetUser != callerUser (creating keys for another user)

Remediation

Allow CreateAccessKey only for self via condition aws:RequestedRegion and IAM condition keys.

#4iam:CreateLoginProfile → Console Accessiam:CreateLoginProfileCriticalT1078.004▼

Required Permission(s)

iam:CreateLoginProfile

Escalation Technique

Create a console password for an IAM user that previously had no console access — turns a programmatic-only user into a console user. Combined with admin permissions, gives full console control.

Detection

CloudTrail: CreateLoginProfile

Remediation

Alert on CreateLoginProfile for any user that already has significant IAM policies attached.

#5iam:UpdateLoginProfile → Account Takeoveriam:UpdateLoginProfileCriticalT1531▼

Required Permission(s)

iam:UpdateLoginProfile

Escalation Technique

Change the console password of any existing IAM user — takes over their console session.

Detection

CloudTrail: UpdateLoginProfile where targetUser != callerUser

Remediation

Restrict UpdateLoginProfile to self only via IAM condition. Alert on any cross-user update.

#6iam:PassRole + ec2:RunInstances → Instance Adminiam:PassRole, ec2:RunInstancesCriticalT1078.004▼

Required Permission(s)

iam:PassRole, ec2:RunInstances

Escalation Technique

Launch a new EC2 instance and pass it a highly privileged IAM role (e.g. AdministratorAccess). SSH into the instance and use IMDS to get the admin credentials.

Detection

CloudTrail: RunInstances where IamInstanceProfile is a high-privilege role, from caller that doesn't normally launch instances

Remediation

Require MFA or SCP condition for RunInstances with privileged roles. Use iam:PassRole with conditions limiting which roles can be passed.

#7iam:PassRole + lambda:CreateFunction + lambda:InvokeFunctioniam:PassRole, lambda:CreateFunction, lambda:InvokeFunctionCriticalT1204.001▼

Required Permission(s)

iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction

Escalation Technique

Create a Lambda function with a highly privileged execution role. Invoke the function with code that calls iam:CreateUser + iam:AttachUserPolicy to create a new admin user.

Detection

CloudTrail: CreateFunction with high-privilege role, immediately followed by InvokeFunction

Remediation

Alert on Lambda functions created with admin-level execution roles. Restrict lambda:CreateFunction via SCPs.

#8iam:PassRole + glue:CreateDevEndpoint → Node Adminiam:PassRole, glue:CreateDevEndpointCriticalT1078.004▼

Required Permission(s)

iam:PassRole, glue:CreateDevEndpoint

Escalation Technique

Create a Glue Development Endpoint with an admin IAM role. SSH into the endpoint node and use IMDS credentials.

Detection

CloudTrail: CreateDevEndpoint with highly privileged Role ARN

Remediation

Block Glue dev endpoint creation via SCP unless from data engineering approved accounts.

#9iam:CreateRole + iam:AttachRolePolicy → New Admin Roleiam:CreateRole, iam:AttachRolePolicyCriticalT1136▼

Required Permission(s)

iam:CreateRole, iam:AttachRolePolicy

Escalation Technique

Create a new IAM role and attach AdministratorAccess policy. Then assume that role if caller also has sts:AssumeRole.

Detection

CloudTrail: CreateRole immediately followed by AttachRolePolicy (AdministratorAccess)

Remediation

SCPs blocking creation of roles with AdministratorAccess without approval workflow.

#10sts:AssumeRole (cross-account trust issues)sts:AssumeRoleCriticalT1550.001▼

Required Permission(s)

sts:AssumeRole

Escalation Technique

If a role trust policy allows * or any account to assume it, attacker in another account or from internet can assume the role directly.

Detection

CloudTrail: AssumeRole from external account IDs or unknown principals

Remediation

IAM Access Analyser detects externally-assumable roles. Alert on cross-account AssumeRole from unexpected accounts.

#11iam:PassRole + cloudformation:CreateStackiam:PassRole, cloudformation:CreateStackHighT1204.001▼

Required Permission(s)

iam:PassRole, cloudformation:CreateStack

Escalation Technique

Create a CloudFormation stack that provisions a Lambda or EC2 with an admin execution role. The resources get the privileged role at creation time.

Detection

CloudTrail: CreateStack with template containing high-privilege PassRole

Remediation

Require cfn-guard or OPA validation on CloudFormation templates before deployment.

#12iam:AttachUserPolicy (to self)iam:AttachUserPolicyHighT1078.004▼

Required Permission(s)

iam:AttachUserPolicy

Escalation Technique

If the caller can attach policies to themselves, attach AdministratorAccess directly — instant privilege escalation.

Detection

CloudTrail: AttachUserPolicy where targetUser == callerUser and policyArn contains AdministratorAccess

Remediation

Restrict AttachUserPolicy via SCP. Require approval workflow for any policy attachment.

#13iam:AttachGroupPolicy + iam:AddUserToGroupiam:AttachGroupPolicy, iam:AddUserToGroupHighT1078.004▼

Required Permission(s)

iam:AttachGroupPolicy, iam:AddUserToGroup

Escalation Technique

Create or modify a group: attach admin policy to a group, then add yourself to that group.

Detection

CloudTrail: AttachGroupPolicy + AddUserToGroup in rapid sequence by same caller

Remediation

Alert on policy attachments to groups immediately followed by group membership changes.

#14s3:GetObject on CloudTrail Bucket → Credential Thefts3:GetObject (on log bucket)HighT1552▼

Required Permission(s)

s3:GetObject (on log bucket)

Escalation Technique

Read CloudTrail logs to find IAM user credentials accidentally logged, API call patterns to understand account structure, and existing high-privilege user ARNs to target.

Detection

CloudTrail: high-volume GetObject on CloudTrail S3 bucket from non-logging service principals

Remediation

Restrict read access on CloudTrail S3 bucket to logging service only. Block bucket listing.

#15secretsmanager:GetSecretValue → Credential Escalationsecretsmanager:GetSecretValueHighT1555▼

Required Permission(s)

secretsmanager:GetSecretValue

Escalation Technique

Read Secrets Manager secrets — may contain IAM access keys, database credentials, or application service credentials for higher-privilege systems.

Detection

CloudTrail: GetSecretValue for secrets not normally accessed by the caller identity

Remediation

Restrict GetSecretValue per secret using resource-based policies. Enable Secrets Manager access logging.

#16ssm:GetParameter (SecureString) → Credential Theftssm:GetParameterHighT1555▼

Required Permission(s)

ssm:GetParameter

Escalation Technique

Read SSM Parameter Store SecureString values — commonly used to store database passwords, API keys, and IAM credentials.

Detection

CloudTrail: GetParameter for SecureString parameters from unusual caller

Remediation

Restrict ssm:GetParameter per parameter path using IAM conditions.

#17ec2:DescribeInstances + ssm:SendCommand → RCE on High-Priv Instancesssm:SendCommandHighT1609▼

Required Permission(s)

ssm:SendCommand

Escalation Technique

Send arbitrary shell commands via SSM to existing EC2 instances with high-privilege roles — extract credentials from IMDS without needing SSH.

Detection

CloudTrail: SendCommand from unexpected caller to instances with privileged roles

Remediation

Restrict SendCommand via tag-based conditions. Alert on cross-account or unusual SSM send patterns.

#18iam:PassRole + ecs:RegisterTaskDefinition + ecs:RunTaskiam:PassRole, ecs:RegisterTaskDefinition, ecs:RunTaskHighT1078.004▼

Required Permission(s)

iam:PassRole, ecs:RegisterTaskDefinition, ecs:RunTask

Escalation Technique

Register a new ECS task definition with a high-privilege task role. Run the task — the container gets admin credentials via IMDS.

Detection

CloudTrail: RegisterTaskDefinition with high-privilege role, followed by RunTask

Remediation

Restrict task definition creation to CI/CD pipelines. Require task role allowlisting via SCP.

#19iam:PassRole + sagemaker:CreateNotebookInstanceiam:PassRole, sagemaker:CreateNotebookInstanceHighT1078.004▼

Required Permission(s)

iam:PassRole, sagemaker:CreateNotebookInstance

Escalation Technique

Create a SageMaker notebook with admin execution role. Use the Jupyter terminal to access IMDS credentials.

Detection

CloudTrail: CreateNotebookInstance with high-privilege role from non-ML team identity

Remediation

Restrict SageMaker notebook creation to ML team. Block admin role usage in SageMaker via SCP.

#20iam:PassRole + codebuild:CreateProject + StartBuildiam:PassRole, codebuild:CreateProject, codebuild:StartBuildHighT1204.001▼

Required Permission(s)

iam:PassRole, codebuild:CreateProject, codebuild:StartBuild

Escalation Technique

Create a CodeBuild project with admin service role. Run a build that exfiltrates environment credentials or creates new IAM users.

Detection

CloudTrail: CreateProject + StartBuild with admin service role from non-DevOps identity

Remediation

Restrict CodeBuild project creation to DevOps team. Alert on builds in projects created in last 24 hours.

#21iam:UpdateAssumeRolePolicy → Trust Policy Modificationiam:UpdateAssumeRolePolicyHighT1078.004▼

Required Permission(s)

iam:UpdateAssumeRolePolicy

Escalation Technique

Modify an existing role's trust policy to allow the attacker's principal to assume it — effectively granting themselves that role's permissions.

Detection

CloudTrail: UpdateAssumeRolePolicy — any modification to trust policy

Remediation

Alert on all UpdateAssumeRolePolicy events. Restrict via SCP.

#22iam:PutRolePolicy → Inline Policy Adminiam:PutRolePolicyHighT1078.004▼

Required Permission(s)

iam:PutRolePolicy

Escalation Technique

Add an inline policy with wildcard permissions to any IAM role — grants that role admin access instantly.

Detection

CloudTrail: PutRolePolicy with Action:* or Action:iam:*

Remediation

Block PutRolePolicy with wildcard permissions via SCP. Alert on all inline policy modifications.

#23iam:PutUserPolicy → Inline Policy Adminiam:PutUserPolicyHighT1078.004▼

Required Permission(s)

iam:PutUserPolicy

Escalation Technique

Same as above but for users — add inline wildcard policy to any user.

Detection

CloudTrail: PutUserPolicy with Action:* in policy document

Remediation

Block PutUserPolicy with wildcard via SCP.

#24iam:PassRole + glue:CreateJob + glue:StartJobRuniam:PassRole, glue:CreateJob, glue:StartJobRunHighT1078.004▼

Required Permission(s)

iam:PassRole, glue:CreateJob, glue:StartJobRun

Escalation Technique

Create a Glue ETL job with admin role — Glue job runs arbitrary Python/Scala with those credentials.

Detection

CloudTrail: CreateJob with admin role, StartJobRun by non-data-team identity

Remediation

Restrict Glue job creation to data engineering team accounts.

#25iam:CreateServiceSpecificCredential (CodeCommit)iam:CreateServiceSpecificCredentialHighT1552.001▼

Required Permission(s)

iam:CreateServiceSpecificCredential

Escalation Technique

Create CodeCommit-specific credentials for any IAM user — if that user has access to repos containing sensitive configs or credentials, enables data theft.

Detection

CloudTrail: CreateServiceSpecificCredential where targetUser != callerUser

Remediation

Alert on cross-user credential creation.

🔷 Azure IAM Privilege Escalation Paths

#1Microsoft.Authorization/roleAssignments/write → OwnerroleAssignments/writeCriticalazure▼

Required Permission(s)

roleAssignments/write

Escalation Technique

If a principal has permission to create role assignments, they can assign Owner role to themselves or another principal on any scope (subscription, resource group, management group).

Detection

Azure Activity Log: roleAssignments write where assignee == caller or unexpected principal. Alert on all Owner-level assignments.

Remediation

Remove roleAssignments/write from non-privileged roles. Use PIM for role assignment capability.

#2Microsoft.Authorization/roleDefinitions/write → Custom Admin RoleroleDefinitions/writeCriticalazure▼

Required Permission(s)

roleDefinitions/write

Escalation Technique

Create a new custom role with wildcard permissions (*/*/write or */*/*) and assign it to yourself. Custom roles with wildcard permissions are equivalent to Owner.

Detection

Azure Activity Log: roleDefinitions write followed by roleAssignments write in rapid sequence

Remediation

Block custom role creation via Azure Policy. Require custom roles to be reviewed.

#3Azure AD Global Administrator password resetUser Administrator or Password Administrator (for admins)Criticalazure▼

Required Permission(s)

User Administrator or Password Administrator (for admins)

Escalation Technique

User Administrator can reset passwords of non-admin users. If escalated to Global Admin role (via PIM), can reset passwords of all users including other admins.

Detection

Azure AD Audit Log: Update user - password reset where target is a Global Admin or Privileged Role Admin

Remediation

Protect Global Admin accounts with Conditional Access requiring strong authentication.

#4Application Administrator → App credential creation → SP privilegeApplication AdministratorCriticalazure▼

Required Permission(s)

Application Administrator

Escalation Technique

Application Administrator can add credentials (client secrets or certificates) to any Azure AD App Registration. If that app's Service Principal has highly privileged directory roles or Azure RBAC, attacker can authenticate as that SP.

Detection

Azure AD Audit Log: Update application - Certificates and secrets management by non-owner

Remediation

Audit App Registrations for privileged SP permissions. Monitor credential additions by non-owners.

#4bManaged Identity → Resource ControlContributor on resource with MICriticalazure▼

Required Permission(s)

Contributor on resource with MI

Escalation Technique

If an Azure resource has a System-assigned Managed Identity with broad permissions, gaining control of that resource (e.g., via a vulnerability in the app it runs) gives access to MI credentials via IMDS.

Detection

Azure Activity Log: IMDS token requests from unexpected resources. Monitor MSI token endpoint access.

Remediation

Apply least privilege to Managed Identities. Audit MI role assignments regularly.

#5Contributor → Automation Account Runbook → Code ExecutionContributorHighazure▼

Required Permission(s)

Contributor

Escalation Technique

Contributor can create or modify Azure Automation Account runbooks that run as the Automation Account's Run As Account (which often has Contributor or higher on the subscription).

Detection

Azure Activity Log: Automation runbook creation/modification by unusual principals

Remediation

Restrict Automation Account access. Audit Run As Account permissions.

#6Key Vault Certificate Officer → Code Signing → Supply ChainKey Vault Certificate OfficerHighazure▼

Required Permission(s)

Key Vault Certificate Officer

Escalation Technique

Certificate Officer can issue and manage certificates. If Key Vault contains code-signing certificates, signing malicious code that appears legitimate.

Detection

Azure Key Vault Diagnostic Logs: certificate operations by non-PKI-team principals

Remediation

Restrict Key Vault operations by certificate purpose. Monitor all certificate issuances.

#7Storage Account Contributor → Blob → Credential ExfiltrationStorage Account ContributorHighazure▼

Required Permission(s)

Storage Account Contributor

Escalation Technique

Can access all data in storage account including configuration files, tfstate files, or backups containing credentials.

Detection

Azure Storage Diagnostic Logs: bulk blob reads or downloads by unexpected principals

Remediation

Apply least privilege on storage accounts. Enable Azure Defender for Storage.

#8Virtual Machine Contributor → Extension Install → RCEVirtual Machine ContributorHighazure▼

Required Permission(s)

Virtual Machine Contributor

Escalation Technique

VM Contributor can install VM Extensions — including Custom Script Extension that runs arbitrary PowerShell/bash. Run as SYSTEM on Windows or root on Linux.

Detection

Azure Activity Log: VM extension installation — especially CustomScript type

Remediation

Restrict VM extension installation via Azure Policy. Alert on CustomScriptExtension deployments.

#9Logic App Contributor → Managed Identity → Graph APILogic App ContributorHighazure▼

Required Permission(s)

Logic App Contributor

Escalation Technique

If a Logic App has a System-assigned MI with Microsoft Graph API permissions (e.g., User.ReadWrite.All), can modify the Logic App workflow to call Graph API on behalf of the MI — read all user data, reset passwords.

Detection

Azure Activity Log: Logic App workflow modification

Remediation

Audit Logic App MI Graph API permissions. Apply least privilege to Logic App identities.

🟡 GCP IAM Privilege Escalation Paths

#1iam.serviceAccounts.setIamPolicy → SA Impersonationiam.serviceAccounts.setIamPolicyCriticalgcp▼

Required Permission(s)

iam.serviceAccounts.setIamPolicy

Escalation Technique

Modify the IAM policy on a Service Account to grant yourself the roles/iam.serviceAccountTokenCreator role — then generate access tokens for that SA. If the SA has high privileges, instant escalation.

Detection

Cloud Audit Logs: SetIamPolicy on service account resource by non-SA-owner identity

Remediation

Alert on SA IAM policy modifications. Restrict setIamPolicy to SA administrators only.

#2iam.roles.update → Custom Role Escalationiam.roles.updateCriticalgcp▼

Required Permission(s)

iam.roles.update

Escalation Technique

Update an existing custom IAM role to include higher-privilege permissions (e.g., add resourcemanager.projects.setIamPolicy to an existing role). All entities with that role instantly get the new permission.

Detection

Cloud Audit Logs: roles.update where new permissions include resourcemanager or iam write operations

Remediation

Alert on all custom role updates. Require change approval for role modifications.

#3resourcemanager.projects.setIamPolicy → Project Ownerresourcemanager.projects.setIamPolicyCriticalgcp▼

Required Permission(s)

resourcemanager.projects.setIamPolicy

Escalation Technique

Directly set the project IAM policy — bind yourself to roles/owner on the project. Full project access.

Detection

Cloud Audit Logs: SetIamPolicy on project resource by non-org-admin identity

Remediation

This permission should be reserved for break-glass accounts only. Audit all holders.

#4iam.serviceAccounts.actAs + compute.instances.create → Instance Credentialiam.serviceAccounts.actAs, compute.instances.createCriticalgcp▼

Required Permission(s)

iam.serviceAccounts.actAs, compute.instances.create

Escalation Technique

Create a Compute instance with a high-privilege SA. SSH to instance and use metadata server to get SA tokens.

Detection

Cloud Audit Logs: instances.insert with high-privilege serviceAccount annotation

Remediation

Restrict compute.instances.create via org policy. Require specific SA allowlist via constraints.

#5cloudfunctions.functions.create + iam.serviceAccounts.actAscloudfunctions.functions.create, iam.serviceAccounts.actAsHighgcp▼

Required Permission(s)

cloudfunctions.functions.create, iam.serviceAccounts.actAs

Escalation Technique

Deploy a Cloud Function with a high-privilege SA runtime account. Invoke the function — it runs as the privileged SA and can create new IAM bindings.

Detection

Cloud Audit Logs: cloudfunctions.functions.create with high-privilege service account

Remediation

Restrict Cloud Function deployment to approved SAs. Alert on function deployments with owner-level SAs.

#6storage.buckets.setIamPolicy → Bucket Data Accessstorage.buckets.setIamPolicyHighgcp▼

Required Permission(s)

storage.buckets.setIamPolicy

Escalation Technique

Modify bucket IAM policy to grant yourself storage.objectViewer or admin — access all bucket data including potential credentials.

Detection

Cloud Audit Logs: SetIamPolicy on storage bucket by non-owner

Remediation

Alert on bucket policy changes. Enable Cloud Audit Data Access logs for storage.

#7cloudrun.services.setIamPolicy + cloudrun.services.createcloudrun.services.setIamPolicyHighgcp▼

Required Permission(s)

cloudrun.services.setIamPolicy

Escalation Technique

Create a Cloud Run service with a high-privilege SA identity. The service container runs as that SA.

Detection

Cloud Audit Logs: Cloud Run service creation with privileged SA

Remediation

Restrict Cloud Run SA to minimum required permissions.

#8secretmanager.versions.access on SA key secretssecretmanager.versions.accessHighgcp▼

Required Permission(s)

secretmanager.versions.access

Escalation Technique

Access Secret Manager secrets containing SA keys, database credentials, or API tokens for higher-privilege systems.

Detection

Cloud Audit Logs: AccessSecretVersion for secrets not normally accessed by the caller

Remediation

Apply IAM conditions on Secret Manager. Enable audit logging for all secret accesses.

🔍 Detection Queries for Privilege Escalation

AWS — CloudTrail KQL (Sentinel)

// Detect rapid IAM permission changes — privilege escalation pattern AWSCloudTrail | where EventName in ( "CreatePolicyVersion","SetDefaultPolicyVersion","AttachUserPolicy", "AttachRolePolicy","AttachGroupPolicy","PutUserPolicy","PutRolePolicy", "CreateAccessKey","UpdateAssumeRolePolicy","CreateLoginProfile","UpdateLoginProfile" ) | summarize Actions=make_set(EventName), Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by UserIdentityArn, SourceIPAddress, bin(TimeGenerated, 30m) | where Count >= 3 // 3+ IAM changes in 30 minutes | project TimeRange=strcat(FirstSeen,"→",LastSeen), Actor=UserIdentityArn, SourceIP=SourceIPAddress, Actions, Count | sort by Count desc

AWS — PassRole to High-Privilege Service (SPL)

index=aws sourcetype="aws:cloudtrail" eventName IN ("RunInstances","CreateFunction","StartBuild","CreateNotebookInstance","RegisterTaskDefinition","CreateDevEndpoint") | spath output=roleArn path=requestParameters.iamInstanceProfile.arn | eval roleArn=coalesce(roleArn, 'requestParameters.role', 'requestParameters.executionRoleArn') | search roleArn="*AdministratorAccess*" OR roleArn="*admin*" OR roleArn="*full*" | table _time, userIdentity.arn, eventName, roleArn, sourceIPAddress, awsRegion | sort -_time

Azure — Role Assignment to High-Privilege Role (KQL)

AzureActivity | where OperationNameValue == "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE" | where ActivityStatusValue == "Success" | extend Properties = parse_json(Properties) | extend RoleName = tostring(Properties.roleDefinitionName) | where RoleName in ("Owner","Contributor","User Access Administrator","Global Administrator") | project TimeGenerated, Caller, RoleName, ResourceGroup, SubscriptionId, CorrelationId | sort by TimeGenerated desc

GCP — SA IAM Policy Change (Log Query)

-- GCP Logging query resource.type="service_account" AND protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND (protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner" OR protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/iam.serviceAccountTokenCreator")