Cloud IAM privilege escalation

When it applies

You have some cloud identity (leaked keys, an SSRF-obtained role — cloud-imds-ssrf, a compromised service account) and want to escalate to admin or reach more resources.

Why it works

IAM is complex and permissions are over-granted. A handful of seemingly-minor permissions form known escalation paths — creating a policy version, attaching a policy, passing a role, updating a function's code/role — that promote a low-priv identity to admin.