AWS Security Review

A structured audit of an AWS account or organization.

1. IAM Deep Dive

• Enumerate users, roles, policies (identity + resource + permission boundaries)
• Hunt privilege escalation paths: iam:CreatePolicyVersion, iam:PassRole + ec2:RunInstances/lambda creation, sts:AssumeRole chains, iam:SetDefaultPolicyVersion
• Wildcard actions/resources on trust boundaries; NotAction with Effect: Allow traps
• Unused credentials, access keys older than 90 days, no rotation
• Check trust policies: roles assumable by * or by external account IDs

Tools

• scoutSuite, prowler, pmapper (privilege escalation graph), cloudsplaining (least-privilege diffs)

2. Exposure Review