IAM Privilege Escalation.

Abusing existing cloud IAM permissions to gain higher privileges, often via policy editing, role passing, or self-granting administrative rights. It belongs to the Cloud Security category of cybersecurity.

Abusing existing cloud IAM permissions to gain higher privileges, often via policy editing, role passing, or self-granting administrative rights.

IAM privilege escalation in cloud environments occurs when a principal with limited permissions uses legitimate API actions to elevate to broader or administrative privileges. Common AWS paths include iam:CreateAccessKey on another user, iam:PutUserPolicy, sts:AssumeRole on a privileged role, lambda:UpdateFunctionCode on a function with a powerful role, or passrole abuse via ec2:RunInstances. Equivalent paths exist in Azure (role assignment writes) and GCP (setIamPolicy). Tools such as Pacu and PMapper enumerate these chains automatically. Defenders restrict iam:Pass, iam:Put, and *:Update permissions, enforce permission boundaries and SCPs, log every IAM change in CloudTrail, and alert on dangerous combinations.

Defences for IAM Privilege Escalation typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Cloud privesc, IAM privesc.