What it does. Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-aws-iam-privilege-escalation, or copy the skill folder into ~/.claude/skills/detecting-aws-iam-privilege-escalation/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-iam-privilege-escalation/SKILL.md

SKILL.md (verbatim)

name: detecting-aws-iam-privilege-escalation
description: Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining
  policy analysis to identify overly permissive policies, dangerous permission combinations,
  and least-privilege violations
domain: cybersecurity
subdomain: cloud-security
tags:
- aws
- iam
- privilege-escalation
- cloudsplaining
- boto3
- policy-analysis
- least-privilege
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.IR-01
- ID.AM-08
- GV.SC-06
- DE.CM-01
mitre_attack:
- T1098.001
- T1098.003
- T1078.004
- T1548.005
- T1484

Detecting AWS IAM Privilege Escalation

Overview

This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.

When to Use

• When investigating security incidents that require detecting aws iam privilege escalation
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.8+ with boto3 library
• AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
• Optional: cloudsplaining Python package for HTML report generation

Steps

1. Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
2. Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
3. Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
4. Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
5. Score and Prioritize Findings — Rank findings by severity based on escalation vector type
6. Generate Report — Produce structured JSON report with remediation guidance

Expected Output

• JSON report of privilege escalation findings with severity scores
• List of dangerous permission combinations per principal
• Wildcard resource policy audit results
• Remediation recommendations for each finding

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

AWS IAM Privilege Escalation Detection API Reference

boto3 IAM API

import boto3

iam = boto3.client("iam")

# Download full account authorization details
paginator = iam.get_paginator("get_account_authorization_details")
for page in paginator.paginate():
    users = page["UserDetailList"]
    roles = page["RoleDetailList"]
    policies = page["Policies"]

# Get specific policy version
policy = iam.get_policy_version(
    PolicyArn="arn:aws:iam::123456789012:policy/MyPolicy",
    VersionId="v2"
)

Cloudsplaining CLI

# Install
pip install cloudsplaining

# Download account authorization details
cloudsplaining download --profile myprofile

# Scan authorization file for privilege escalation
cloudsplaining scan --input-file default.json --output results/

# Scan a single policy file
cloudsplaining scan-policy-file --input-file policy.json

Known Privilege Escalation Vectors

AWS CLI IAM Audit Commands

# List all users with attached policies
aws iam list-users --output json

# Get user's inline policies
aws iam list-user-policies --user-name admin

# Get attached managed policies
aws iam list-attached-user-policies --user-name admin

# Simulate policy evaluation
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/admin \
  --action-names iam:CreatePolicyVersion iam:AttachUserPolicy

# Get account authorization details (full dump)
aws iam get-account-authorization-details > auth-details.json

Parliament (Policy Linting)

pip install parliament
parliament --file policy.json

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.