Cloud IAM Least-Privilege & Escalation Analyzer

Statement grants unconditional administrative access across every AWS service and resource in the account.

Permission to iam:PassRole allows passing privileged roles to newly launched instances, Lambda functions, or ECS tasks to extract administrative tokens.

Allows generating persistent API access keys for other IAM users without administrative approval.

Grants permission to attach AdministratorAccess or inject inline policies directly onto user identities.

Allows modifying existing IAM role definitions or escalating execution role privileges.

Allows creating a new version of an attached customer-managed policy granting full administrator permissions.

Allows assuming any role in the AWS account or cross-account without resource restriction.

Allows modifying S3 bucket access policies, enabling an adversary to expose private buckets to the public internet.

Grants ability to create or reset passwords for AWS console access on unauthorized IAM user identities.

Allows adding arbitrary IAM users to privileged administrative groups without governance oversight.

Allows attaching administrative policies to IAM groups to indirectly escalate user privileges.

Allows deploying arbitrary Lambda functions with privileged execution roles to run administrative code in-cloud.

Allows provisioning an AWS Glue DevEndpoint attached to a privileged service role to extract STS credentials.

Allows executing arbitrary CloudFormation templates under administrative service roles to create backdoor resources.