docs(aws): restore reference and TODO comments in privilege escalation patterns

Restore comments that were inadvertently removed during refactoring: - Add reference URL for ECS StartTask privilege escalation path - Add TODO comment for AssumeRole handling considerations
docs(aws): add prerequisite comments to privilege escalation patterns
2026-02-09 02:30:43 +00:00 · 2026-01-29 14:28:03 +01:00 · 2026-01-29 09:53:55 +01:00 · 2026-01-28 10:38:49 +01:00
1 changed files with 216 additions and 33 deletions
--- a/prowler/providers/aws/services/iam/lib/privilege_escalation.py
+++ b/prowler/providers/aws/services/iam/lib/privilege_escalation.py
@@ -18,16 +18,88 @@ from prowler.providers.aws.services.iam.lib.policy import get_effective_actions
 # - https://bishopfox.com/blog/privilege-escalation-in-aws
 # - https://github.com/RhinoSecurityLabs/Security-Research/blob/master/tools/aws-pentest-tools/aws_escalate.py
 # - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
+# - https://github.com/DataDog/pathfinding.cloud (AWS IAM Privilege Escalation Path Library)

 privilege_escalation_policies_combination = {
+    # IAM self-escalation and policy manipulation
    "OverPermissiveIAM": {"iam:*"},
    "IAMPut": {"iam:Put*"},
    "CreatePolicyVersion": {"iam:CreatePolicyVersion"},
    "SetDefaultPolicyVersion": {"iam:SetDefaultPolicyVersion"},
+    "iam:CreateAccessKey": {"iam:CreateAccessKey"},
+    "iam:CreateLoginProfile": {"iam:CreateLoginProfile"},
+    "iam:UpdateLoginProfile": {"iam:UpdateLoginProfile"},
+    "iam:AttachUserPolicy": {"iam:AttachUserPolicy"},
+    "iam:AttachGroupPolicy": {"iam:AttachGroupPolicy"},
+    "iam:AttachRolePolicy": {"iam:AttachRolePolicy"},
+    "iam:PutGroupPolicy": {"iam:PutGroupPolicy"},
+    "iam:PutRolePolicy": {"iam:PutRolePolicy"},
+    "iam:PutUserPolicy": {"iam:PutUserPolicy"},
+    "iam:AddUserToGroup": {"iam:AddUserToGroup"},
+    "iam:UpdateAssumeRolePolicy": {"iam:UpdateAssumeRolePolicy"},
+    # IAM chained privilege escalation patterns
+    "CreateAccessKey+DeleteAccessKey": {
+        "iam:CreateAccessKey",
+        "iam:DeleteAccessKey",
+    },
+    "AttachUserPolicy+CreateAccessKey": {
+        "iam:AttachUserPolicy",
+        "iam:CreateAccessKey",
+    },
+    "PutUserPolicy+CreateAccessKey": {
+        "iam:PutUserPolicy",
+        "iam:CreateAccessKey",
+    },
+    "AttachRolePolicy+UpdateAssumeRolePolicy": {
+        "iam:AttachRolePolicy",
+        "iam:UpdateAssumeRolePolicy",
+    },
+    "CreatePolicyVersion+UpdateAssumeRolePolicy": {
+        "iam:CreatePolicyVersion",
+        "iam:UpdateAssumeRolePolicy",
+    },
+    "PutRolePolicy+UpdateAssumeRolePolicy": {
+        "iam:PutRolePolicy",
+        "iam:UpdateAssumeRolePolicy",
+    },
+    # STS-based privilege escalation patterns
+    "AssumeRole+AttachRolePolicy": {"sts:AssumeRole", "iam:AttachRolePolicy"},
+    "AssumeRole+PutRolePolicy": {"sts:AssumeRole", "iam:PutRolePolicy"},
+    "AssumeRole+UpdateAssumeRolePolicy": {
+        "sts:AssumeRole",
+        "iam:UpdateAssumeRolePolicy",
+    },
+    "AssumeRole+CreatePolicyVersion": {
+        "sts:AssumeRole",
+        "iam:CreatePolicyVersion",
+    },
+    # EC2-based privilege escalation patterns
    "PassRole+EC2": {
        "iam:PassRole",
        "ec2:RunInstances",
    },
+    "PassRole+EC2SpotInstances": {
+        "iam:PassRole",
+        "ec2:RequestSpotInstances",
+    },
+    # Prerequisite: Existing EC2 instance with admin role attached
+    "EC2ModifyInstanceAttribute": {
+        "ec2:ModifyInstanceAttribute",
+        "ec2:StopInstances",
+        "ec2:StartInstances",
+    },
+    # Prerequisite: Existing launch template used by instances with admin role
+    "EC2ModifyLaunchTemplate": {
+        "ec2:CreateLaunchTemplateVersion",
+        "ec2:ModifyLaunchTemplate",
+    },
+    # EC2 Instance Connect privilege escalation
+    # Prerequisite: Running EC2 with Instance Connect enabled and admin role
+    "EC2InstanceConnect+SendSSHPublicKey": {
+        "ec2-instance-connect:SendSSHPublicKey",
+        "ec2:DescribeInstances",
+    },
+    # Lambda-based privilege escalation patterns
    "PassRole+CreateLambda+Invoke": {
        "iam:PassRole",
        "lambda:CreateFunction",
@@ -45,68 +117,131 @@ privilege_escalation_policies_combination = {
        "dynamodb:CreateTable",
        "dynamodb:PutItem",
    },
-    "PassRole+GlueEndpoint": {
+    "PassRole+CreateLambda+AddPermission": {
+        "iam:PassRole",
+        "lambda:CreateFunction",
+        "lambda:AddPermission",
+    },
+    # Prerequisite: Existing Lambda function with admin execution role
+    "lambda:UpdateFunctionCode": {"lambda:UpdateFunctionCode"},
+    # Prerequisite: Existing Lambda function with admin execution role
+    "lambda:UpdateFunctionConfiguration": {"lambda:UpdateFunctionConfiguration"},
+    # Prerequisite: Existing Lambda function with admin execution role
+    "UpdateFunctionCode+InvokeFunction": {
+        "lambda:UpdateFunctionCode",
+        "lambda:InvokeFunction",
+    },
+    # Prerequisite: Existing Lambda function with admin execution role
+    "UpdateFunctionCode+AddPermission": {
+        "lambda:UpdateFunctionCode",
+        "lambda:AddPermission",
+    },
+    # Glue-based privilege escalation patterns
+    "PassRole+GlueCreateDevEndpoint": {
        "iam:PassRole",
        "glue:CreateDevEndpoint",
-        "glue:GetDevEndpoint",
    },
-    "PassRole+GlueEndpoints": {
+    # Prerequisite: Existing Glue dev endpoint with admin role
+    "GlueUpdateDevEndpoint": {"glue:UpdateDevEndpoint"},
+    "PassRole+GlueCreateJob+StartJobRun": {
        "iam:PassRole",
-        "glue:CreateDevEndpoint",
-        "glue:GetDevEndpoints",
+        "glue:CreateJob",
+        "glue:StartJobRun",
    },
-    "PassRole+CloudFormation": {
+    "PassRole+GlueCreateJob+CreateTrigger": {
+        "iam:PassRole",
+        "glue:CreateJob",
+        "glue:CreateTrigger",
+    },
+    # Prerequisite: Existing Glue job
+    "PassRole+GlueUpdateJob+StartJobRun": {
+        "iam:PassRole",
+        "glue:UpdateJob",
+        "glue:StartJobRun",
+    },
+    # Prerequisite: Existing Glue job
+    "PassRole+GlueUpdateJob+CreateTrigger": {
+        "iam:PassRole",
+        "glue:UpdateJob",
+        "glue:CreateTrigger",
+    },
+    # CloudFormation-based privilege escalation patterns
+    "PassRole+CloudFormationCreateStack": {
        "iam:PassRole",
        "cloudformation:CreateStack",
-        "cloudformation:DescribeStacks",
    },
+    # Prerequisite: Existing CloudFormation stack with admin service role
+    "CloudFormationUpdateStack": {"cloudformation:UpdateStack"},
+    "PassRole+CloudFormationCreateStackSet": {
+        "iam:PassRole",
+        "cloudformation:CreateStackSet",
+        "cloudformation:CreateStackInstances",
+    },
+    # Prerequisite: Existing CloudFormation StackSet
+    "PassRole+CloudFormationUpdateStackSet": {
+        "iam:PassRole",
+        "cloudformation:UpdateStackSet",
+    },
+    # Prerequisite: Existing CloudFormation stack with admin service role
+    "CloudFormationChangeSet": {
+        "cloudformation:CreateChangeSet",
+        "cloudformation:ExecuteChangeSet",
+    },
+    # DataPipeline-based privilege escalation patterns
    "PassRole+DataPipeline": {
        "iam:PassRole",
        "datapipeline:CreatePipeline",
        "datapipeline:PutPipelineDefinition",
        "datapipeline:ActivatePipeline",
    },
-    "GlueUpdateDevEndpoint": {"glue:UpdateDevEndpoint"},
-    "lambda:UpdateFunctionCode": {"lambda:UpdateFunctionCode"},
-    "lambda:UpdateFunctionConfiguration": {"lambda:UpdateFunctionConfiguration"},
+    # CodeStar-based privilege escalation patterns
    "PassRole+CodeStar": {
        "iam:PassRole",
        "codestar:CreateProject",
    },
+    # CodeBuild-based privilege escalation patterns
+    "PassRole+CodeBuildCreateProject+StartBuild": {
+        "iam:PassRole",
+        "codebuild:CreateProject",
+        "codebuild:StartBuild",
+    },
+    "PassRole+CodeBuildCreateProject+StartBuildBatch": {
+        "iam:PassRole",
+        "codebuild:CreateProject",
+        "codebuild:StartBuildBatch",
+    },
+    # Prerequisite: Existing CodeBuild project with admin service role
+    "CodeBuildStartBuild": {"codebuild:StartBuild"},
+    # Prerequisite: Existing CodeBuild project with admin service role
+    "CodeBuildStartBuildBatch": {"codebuild:StartBuildBatch"},
+    # AutoScaling-based privilege escalation patterns
    "PassRole+CreateAutoScaling": {
        "iam:PassRole",
        "autoscaling:CreateAutoScalingGroup",
        "autoscaling:CreateLaunchConfiguration",
    },
+    # Prerequisite: Existing Auto Scaling group
    "PassRole+UpdateAutoScaling": {
        "iam:PassRole",
        "autoscaling:UpdateAutoScalingGroup",
        "autoscaling:CreateLaunchConfiguration",
    },
-    "iam:CreateAccessKey": {"iam:CreateAccessKey"},
-    "iam:CreateLoginProfile": {"iam:CreateLoginProfile"},
-    "iam:UpdateLoginProfile": {"iam:UpdateLoginProfile"},
-    "iam:AttachUserPolicy": {"iam:AttachUserPolicy"},
-    "iam:AttachGroupPolicy": {"iam:AttachGroupPolicy"},
-    "iam:AttachRolePolicy": {"iam:AttachRolePolicy"},
-    "AssumeRole+AttachRolePolicy": {"sts:AssumeRole", "iam:AttachRolePolicy"},
-    "iam:PutGroupPolicy": {"iam:PutGroupPolicy"},
-    "iam:PutRolePolicy": {"iam:PutRolePolicy"},
-    "AssumeRole+PutRolePolicy": {"sts:AssumeRole", "iam:PutRolePolicy"},
-    "iam:PutUserPolicy": {"iam:PutUserPolicy"},
-    "iam:AddUserToGroup": {"iam:AddUserToGroup"},
-    "iam:UpdateAssumeRolePolicy": {"iam:UpdateAssumeRolePolicy"},
-    "AssumeRole+UpdateAssumeRolePolicy": {
-        "sts:AssumeRole",
-        "iam:UpdateAssumeRolePolicy",
-    },
-    # AgentCore privilege escalation patterns
-    "PassRole+AgentCoreCreateInterpreter+InvokeInterpreter": {
-        "iam:PassRole",
-        "bedrock-agentcore:CreateCodeInterpreter",
-        "bedrock-agentcore:InvokeCodeInterpreter",
-    },
    # ECS-based privilege escalation patterns
+    "PassRole+ECS+RegisterTaskDef+CreateService": {
+        "iam:PassRole",
+        "ecs:RegisterTaskDefinition",
+        "ecs:CreateService",
+    },
+    "PassRole+ECS+RegisterTaskDef+RunTask": {
+        "iam:PassRole",
+        "ecs:RegisterTaskDefinition",
+        "ecs:RunTask",
+    },
+    "PassRole+ECS+RegisterTaskDef+StartTask": {
+        "iam:PassRole",
+        "ecs:RegisterTaskDefinition",
+        "ecs:StartTask",
+    },
    # Reference: https://labs.reversec.com/posts/2025/08/another-ecs-privilege-escalation-path
    "PassRole+ECS+StartTask": {
        "iam:PassRole",
@@ -114,10 +249,58 @@ privilege_escalation_policies_combination = {
        "ecs:RegisterContainerInstance",
        "ecs:DeregisterContainerInstance",
    },
+    # Prerequisite: Existing ECS cluster and task definition with admin role
    "PassRole+ECS+RunTask": {
        "iam:PassRole",
        "ecs:RunTask",
    },
+    # SageMaker-based privilege escalation patterns
+    "PassRole+SageMakerCreateNotebookInstance": {
+        "iam:PassRole",
+        "sagemaker:CreateNotebookInstance",
+    },
+    "PassRole+SageMakerCreateTrainingJob": {
+        "iam:PassRole",
+        "sagemaker:CreateTrainingJob",
+    },
+    "PassRole+SageMakerCreateProcessingJob": {
+        "iam:PassRole",
+        "sagemaker:CreateProcessingJob",
+    },
+    # Prerequisite: Existing SageMaker notebook instance with admin role
+    "SageMakerCreatePresignedNotebookInstanceUrl": {
+        "sagemaker:CreatePresignedNotebookInstanceUrl",
+    },
+    # Prerequisite: Existing SageMaker notebook instance with admin role
+    "SageMakerNotebookLifecycleConfig": {
+        "sagemaker:CreateNotebookInstanceLifecycleConfig",
+        "sagemaker:StopNotebookInstance",
+        "sagemaker:UpdateNotebookInstance",
+        "sagemaker:StartNotebookInstance",
+    },
+    # SSM-based privilege escalation patterns
+    # Prerequisite: Running EC2 with SSM agent and admin instance profile
+    "SSMStartSession": {"ssm:StartSession"},
+    # Prerequisite: Running EC2 with SSM agent and admin instance profile
+    "SSMSendCommand": {"ssm:SendCommand"},
+    # AppRunner-based privilege escalation patterns
+    "PassRole+AppRunnerCreateService": {
+        "iam:PassRole",
+        "apprunner:CreateService",
+    },
+    # Prerequisite: Existing App Runner service with admin role
+    "AppRunnerUpdateService": {"apprunner:UpdateService"},
+    # Bedrock AgentCore privilege escalation patterns
+    "PassRole+AgentCoreCreateInterpreter+InvokeInterpreter": {
+        "iam:PassRole",
+        "bedrock-agentcore:CreateCodeInterpreter",
+        "bedrock-agentcore:InvokeCodeInterpreter",
+    },
+    # Prerequisite: Existing Bedrock code interpreter with admin role
+    "AgentCoreSessionInvoke": {
+        "bedrock-agentcore:StartCodeInterpreterSession",
+        "bedrock-agentcore:InvokeCodeInterpreter",
+    },
    # TO-DO: We have to handle AssumeRole just if the resource is * and without conditions
    # "sts:AssumeRole": {"sts:AssumeRole"},
 }