Cloud IAM Misconfig Playground
A role holds one deceptively small permission. Chain it into full account takeover through iam:PassRole.
One permission that looks minor on a policy review — and chains into full account takeover. iam:PassRole is the classic: the ability to hand a role to a service you can start is the ability to become that role.
How to use it
- Review the role's permissions.
- Find the one that permits passing a role.
- Chain it into privileges you were never granted.
What to take away
Permissions compose in ways policies do not show
Each grant looks reasonable alone. Escalation lives in the combination, which is why policy review by inspection misses it.
PassRole needs a resource constraint
Granting iam:PassRole on * lets the holder pass any role, including administrative ones. Constrain it to specific roles, always.
Cloud is an identity problem
There is no network perimeter to hide behind. Identity and its permissions are the perimeter.
Frequently asked questions
What is iam:PassRole?
The permission to give a role to an AWS service when you create a resource. Without a resource constraint it is effectively "become any role this account has".
How do I find these paths in my own account?
Automated policy analysis — IAM Access Analyzer, or open-source tools that build the permission graph — because manual review reliably misses multi-step chains.
Where this fits in the course
This security lab pairs with Path 16 — Advanced — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Docker Escape Playground — A container mounts the host's Docker socket. Use it to spin up a privileged container and step onto the host itself.
- SSRF Playground — A "fetch this URL for me" feature with no allowlist. Point it at internal-looking addresses and see what it leaks.
- Leaked Secret Hunt — A public GitHub repo dump. Find the hardcoded API key an automated scanner would catch in minutes — before an attacker does.
- Compliance Control Mapper — Look up how one control area maps across SOC 2, ISO 27001, NIST 800-53, and PCI-DSS.