PreviewLab5 hours

Incident Response

Walk through privilege escalation paths, data exfiltration scenarios, and incident-response playbooks with IAM forensics.

Prerequisites

0 of 6 checked

Mental Model: What This Lab Is

each part follows the same three-phase structure.

The goal is not to memorise commands, it's to develop the habit of asking "what can go wrong here?" before deploying IAM configuration.

Privilege Escalation Paths

Goal

Build a role with limited permissions that contains a privilege escalation path. Exploit the path to reach admin-equivalent access. Then detect it using Access Analyzer + simulate, and close it.

Estimated time: 1–2 hours

The most common escalation paths

What's happening here

Privilege escalation in IAM happens when a principal with limited permissions can use those permissions to grant themselves (or another principal they control) additional permissions. The most common paths:

iam:CreatePolicyVersion on their own policy, can add iam:* to themselves
iam:AttachUserPolicy or iam:AttachRolePolicy: can attach AdministratorAccess to themselves
iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction: pass an admin role to Lambda, invoke it to call admin APIs
iam:CreateRole + iam:AttachRolePolicy: create a new admin role, assume it
sts:AssumeRole on a role that trusts them but has broader permissions than they have

All of these are detectable with simulate-principal-policy before they're exploited.

Incident Response

Prerequisites

Mental Model: What This Lab Is

Privilege Escalation Paths

The most common escalation paths

Build the vulnerable role