skills.rest
marcboggs
marcboggsCOMMUNITY
Explore all skills by this author →
GitHub

cloud-iam-deep

Enumerates and escalates privileges for leaked AWS, Azure, GCP, and Kubernetes credentials during red-team engagements.

1|Updated Aug 21, 2026
Search Tags:#aws#gcp#azure#iam#privilege escalation#cloud security#red team
One-click install
npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill cloud-iam-deep-marcboggs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloud-iam-deep
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/.claude/skills/cloud-iam-deep
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill cloud-iam-deep-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When a cloud credential surfaces during an external engagement — an AWS access key in a JS bundle, a GCP service account JSON in an APK, an Azure token via SSRF — testers need a fast, structured way to determine what the credential grants and how to escalate privileges without guesswork or destructive mistakes. ## Core Features & Use Cases - Credential Identification & Validation: Recognize AWS key prefixes (AKIA/ASIA), Azure storage keys, GCP service account JSON, and K8s SA tokens, then validate with safe read-only calls like aws sts get-caller-identity. - Privilege Escalation Playbooks: Lookup tables mapping 24+ AWS, 8+ Azure, and 6+ GCP IAM permissions to concrete escalation techniques (PassRole chains, login profile resets, service account key creation). - IMDS & Managed Identity Abuse: Step-by-step SSRF-to-metadata chains for AWS IMDSv1/v2, Azure Managed Identity tokens, and GCP metadata endpoints. - Cognito Identity Pool Attack Chain: Full unauthenticated-role workflow from IdentityPoolId discovery through GetId, GetCredentialsForIdentity, and permission enumeration with severity rubric. - Use Case: An SSRF finding reaches the EC2 metadata endpoint and returns temporary credentials. Use this Skill to identify the assumed role, enumerate attached policies, map a PassRole-to-Lambda escalation path, and document the finding with severity scoring and cleanup notes. ## Quick Start Use the cloud-iam-deep skill to analyze this leaked AWS access key and tell me what privileges it grants and how the role could be escalated.

Frequently Asked Questions about cloud-iam-deep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check what permissions a leaked AWS access key has?▼

Start with aws sts get-caller-identity to identify the principal and account, then run read-only enumeration like aws iam list-attached-user-policies and service probes (s3 ls, lambda list-functions). Tools like Pacu iam__enum_permissions or enumerate-iam.py brute-force hundreds of API calls to map granted actions.

How to escalate privileges with AWS iam:PassRole permission?▼

iam:PassRole combined with a service creation action lets you run resources as a higher-privilege role. Common paths include ec2:RunInstances with an admin instance profile, lambda:CreateFunction with code execution as the role, or cloudformation:CreateStack deploying resources as admin.

Can SSRF be used to steal cloud credentials from metadata endpoints?▼

Yes, SSRF reaching 169.254.169.254 can return instance role credentials on AWS IMDSv1 with a plain GET, while IMDSv2 requires a PUT token request first. Azure and GCP metadata endpoints similarly expose Managed Identity and service account tokens when the required headers are sent.

What is the AWS Cognito Identity Pool unauthenticated attack?▼

Identity Pools with unauthenticated access enabled let any anonymous caller obtain IAM credentials via GetId then GetCredentialsForIdentity using the publicly exposed IdentityPoolId. If the unauth role has broad permissions like s3:Get* or iam:PassRole, it leads to data breach or full account takeover.

When should I not use cloud IAM exploitation techniques?▼

Avoid them for on-prem-only environments, web vulnerabilities unrelated to cloud control planes, and any write or delete operations without explicit client approval. IAM mutations are destructive and fully logged in CloudTrail, so engagements may be read-only per the statement of work.

What tools automate cloud IAM privilege escalation enumeration?▼

Pacu covers AWS with 100+ modules including permission enumeration, PMapper visualizes AWS privesc paths as graphs, MicroBurst and ROADtools target Azure, and Peirates handles Kubernetes clusters. Prowler and ScoutSuite provide multi-cloud audit coverage.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

cloud-metadata

Detect and exploit cloud instance metadata across AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud.

Official
Advanced
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
grivera82grivera82

mid-engagement-ir-detection

Detect and log mid-engagement state changes to confirm vulnerabilities and mitigations.

Community
Advanced
xalgordxalgord
954

auditing-cloud-with-cis-benchmarks

Audit AWS, Azure, and GCP environments against CIS Foundations Benchmarks using Prowler and ScoutSuite.

Community
Intermediate