Home/IAM Analyzer
☁️ Cloud Security Posture & Identity GovernanceIAM Policy Hardener

Cloud IAM Least-Privilege & Escalation Analyzer

Neutralize identity-based cloud takeovers. Audit AWS IAM policy documents against 20+ dangerous privilege escalation vectors (such as iam:PassRole combined with compute, backdoor iam:CreateAccessKey, or unrestricted sts:AssumeRole), enforce MFA and IP guardrails, and auto-harden your JSON policies with 1-click.

Cloud IAM Policy Presets & Test Scenarios

Test known privilege escalation vectors, overly broad wildcards, or audited CI/CD baselines.

AWS IAM Policy Document (JSON)
IAM Posture IndexGrade F
0%least-privilege score
Critical6
High2
Medium0
Total Issues8

1-Click Auto-Hardener

Instantly resolve wildcards, scope resource ARNs, and inject mandatory MFA condition blocks into this policy.

CRITICALFull Administrator Privileges (* on *)
AllowAllActionsWildcard

Statement grants unconditional administrative access across every AWS service and resource in the account.

Remediation: Replace with scoped, role-specific actions and explicitly defined resource ARNs.
CRITICALArbitrary Role Impersonation (PassRole + EC2/Lambda/ECS)
AllowAllActionsWildcard

Permission to iam:PassRole allows passing privileged roles to newly launched instances, Lambda functions, or ECS tasks to extract administrative tokens.

Remediation: Constrain iam:PassRole strictly to designated role ARNs using explicit Resource blocks and iam:PassedToService conditions.
CRITICALBackdoor Credential Creation (iam:CreateAccessKey)
AllowAllActionsWildcard

Allows generating persistent API access keys for other IAM users without administrative approval.

Remediation: Restrict iam:CreateAccessKey to self-service credentials using the arn:aws:iam::*:user/${aws:username} policy variable.
CRITICALArbitrary Policy Attachment (iam:AttachUserPolicy / PutUserPolicy)
AllowAllActionsWildcard

Grants permission to attach AdministratorAccess or inject inline policies directly onto user identities.

Remediation: Implement AWS Permissions Boundaries (iam:PermissionsBoundary) to limit the maximum privileges delegable.
CRITICALRole Policy Manipulation (iam:AttachRolePolicy / PutRolePolicy)
AllowAllActionsWildcard

Allows modifying existing IAM role definitions or escalating execution role privileges.

Remediation: Require strict permissions boundaries and deny modifications to roles with administrative policies.
CRITICALPolicy Version Escalation (iam:CreatePolicyVersion)
AllowAllActionsWildcard

Allows creating a new version of an attached customer-managed policy granting full administrator permissions.

Remediation: Remove iam:CreatePolicyVersion from non-security administrators and enforce infrastructure-as-code deployments.
HIGHUnrestricted Role Assumption (sts:AssumeRole on Wildcard)
AllowAllActionsWildcard

Allows assuming any role in the AWS account or cross-account without resource restriction.

Remediation: Scope sts:AssumeRole strictly to authorized target role ARNs: arn:aws:iam::ACCOUNT:role/TargetRoleName.
HIGHS3 Bucket Policy Tampering (s3:PutBucketPolicy)
AllowAllActionsWildcard

Allows modifying S3 bucket access policies, enabling an adversary to expose private buckets to the public internet.

Remediation: Activate S3 Block Public Access at the AWS account level and restrict s3:PutBucketPolicy to SecOps break-glass roles.