Skill Market

detecting aws iam privilege escalation

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive

GitHub
githubcommunityai-agentsclaude-codecloud-securitycybersecuritydevsecopsethical-hacking
0.0
0 installs33.4K GitHub starsby mukul975

Skill Introduction

Overview
Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive

Core value

Turns reusable Other know-how into an installable skill, helping users complete github, community, ai-agents, claude-code work faster.

Target users

  • Developers, testers, and maintainers who handle Other tasks in Focus Code.
  • Teams that already trust workflows or content from mukul975.
  • Users who want standardized prompts, steps, or conventions instead of repeating setup work.

Best practices

  • Read the skill content first to confirm required inputs, expected outputs, and dependencies.
  • Try it on a small task before relying on it for critical work.
  • Add project-specific constraints such as coding style, target platform, test expectations, and delivery format.
  • For external sources, verify the source link, version, and recent maintenance activity.

Best use cases

  • Tasks related to github, community, ai-agents, claude-code that need a reusable execution flow.
  • Converting a community repo, team convention, or personal workflow into day-to-day assistance.
  • Starting from a proven skill instead of writing prompts or procedures from scratch.

Limits and boundaries

  • Results depend on the quality of the original skill content and may need human correction.
  • It does not replace code review, tests, security review, or professional judgment.
  • External tools, APIs, account permissions, and local dependencies still need separate setup.

Differentiation

  • Structured around Other, making it easier to discover and reuse than loose prompt snippets.
  • Marked as GitHub, which helps users judge trust and maintenance expectations.
  • Keeps the original source link available for repository, documentation, or discussion follow-up.
  • Tagged with github, community, ai-agents, claude-code, so it can be filtered by concrete task intent.

Install and use

Install
Copy Install Command
focus install detecting-aws-iam-privilege-escalation-271c9f
View source

Detail Preview

SKILL.md

Primary filemarkdown3 KB

name: detecting-aws-iam-privilege-escalation description: Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations domain: cybersecurity subdomain: cloud-security tags:

  • aws
  • iam
  • privilege-escalation
  • cloudsplaining
  • boto3
  • policy-analysis
  • least-privilege version: '1.0' author: mahipal license: Apache-2.0 nist_csf:
  • PR.IR-01
  • ID.AM-08
  • GV.SC-06
  • DE.CM-01

Detecting AWS IAM Privilege Escalation

Overview

This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.

When to Use

  • When investigating security incidents that require detecting aws iam privilege escalation
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.8+ with boto3 library
  • AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
  • Optional: cloudsplaining Python package for HTML report generation

Steps

  1. Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
  2. Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
  3. Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
  4. Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
  5. Score and Prioritize Findings — Rank findings by severity based on escalation vector type
  6. Generate Report — Produce structured JSON report with remediation guidance

Expected Output

  • JSON report of privilege escalation findings with severity scores
  • List of dangerous permission combinations per principal
  • Wildcard resource policy audit results
  • Remediation recommendations for each finding

Reviews

Overall rating

0.0
0.0

0 comments

No reviews yet