AWS IAM Enumeration

Prerequisites

Before starting this room, it is beneficial to have an introductory knowledge of Identity and Access Management (IAM) in AWS and should understand how an AssumeRoleTrust policy works. If you are unfamiliar with this topic, please visit the AWS IAM room for more information.

Learning Objectives

Knowing how to get information about AWS IAM resources without authenticating is an important skill for vulnerability assessments and penetration testing. In this room, you will learn how to perform IAM Principal enumeration and partial service enumeration for AWS environments. You will learn:

• How IAM resource policies can be abused to identify valid IAM principals
• How to use open source tools to efficiently enumerate valid principals in a given AWS account
• How to footprint potential services, including security services, enabled for an account

Remember, these IAM Principals form the backbone of access in AWS - without them, there is almost nothing you can do. By being able to identify what valid principals exist in another AWS account - you form a basis of information to perform more well-informed attacks that are more likely to succeed.

It is possible to get information about IAM principals from a target account and other insider information about an account while remaining unauthenticated to that account - this is referred to as unauthenticated IAM enumeration. IAM enumeration is a reconnaissance exercise that can be leveraged to attack an AWS cloud environment, and by using this technique, an attacker can gain a better understanding of the IAM landscape within an account without having access to it. AWS pen testers and red teamers commonly use this gathered “insider knowledge” to gain information about resources residing within an AWS environment in order to perform attacks against the target account.