Case Study: AWS IAM Attack Path & Least-Privilege Remediation

Project: [REDACTED_ID] Stage 7 (Ethical Hacking / Cloud Security)
Role: Cloud Penetration Tester
Technologies: AWS CLI, IAM, CloudTrail, Terraform, Python, jq

Executive Summary

In this advanced cloud assessment for the Ubuntu Bridge Initiative (UBI), I was tasked with compromising a custom AWS IAM range derived from CloudGoat. The objective was to traverse complex trust boundaries to extract a high-value secret, followed by engineering a robust least-privilege remediation patch using Terraform.

Objectives

• Enumerate a dedicated AWS lab environment (trust policies, permission boundaries, workload roles) without external hints.
• Traverse four scored permission edges to escalate privileges and access the target secret.
• Preserve CloudTrail logs for every decisive API call for forensic accountability.
• Implement Terraform patches to enforce least-privilege, followed by business and negative attack-path testing.

The Attack Path

Enumeration & Privilege Escalation

Starting with limited access as richard-lab-admin, I utilized the AWS CLI and custom scripts to map the IAM effective permissions and trust relationships.

• Assume Role & Pass Role: I successfully identified an entry role that allowed me to assume higher privileges.
• Lambda Function Creation: By leveraging iam:PassRole, I created a serverless AWS Lambda function embedded with an execution role that had broader access to the environment.
• Secret Extraction: Using the Lambda function's elevated permissions, I traversed the final permission edge to retrieve the assigned "crown jewel" secret from AWS Secrets Manager.

Remediation & Testing

• Infrastructure as Code (IaC) Patching: I analyzed the supplied Terraform definitions and rewrote the IAM policies. I enforced strict Resource boundaries and limited the AssumeRole and PassRole trust relationships to prevent horizontal and vertical privilege escalation.
• Validation: I redeployed the patched infrastructure and executed an automated test suite (tests/run_tests.py).
  • Positive Business Tests: Ensured legitimate application functions remained operational.
  • Negative Attack Tests: Confirmed the previous attack paths (including the Lambda creation vector) were successfully blocked.
• Teardown & Verification: Destroyed the environment within cost SLAs and ran a residual verification script (residual-checks.json) to guarantee a clean teardown.

Usage & Execution

1. Deploy the Vulnerable Environment

terraform init
terraform apply -var-file=terraform.tfvars

2. Execute Attack Path & Remediate

1. Run the scripts in enumeration/ to assume the entry role, pass the role to a new Lambda function, and retrieve the crown jewel secret.
2. Deploy the remediation Terraform patch located in remediation/.

3. Verification & Teardown

Run the automated test suite to verify the business logic works and the attack is blocked:

python3 tests/run_tests.py

Finally, safely destroy the environment:

terraform destroy

---

This project demonstrates my proficiency in Cloud Penetration Testing, specifically my deep understanding of AWS IAM misconfigurations, lateral movement in the cloud, and my ability to secure infrastructure via Terraform.