IAM Vulnerable

Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.

IAM Vulnerable uses the Terraform binary and your AWS credentials to deploy over 250 IAM resources into your selected AWS account. Within minutes, you can start learning how to identify and exploit vulnerable IAM configurations that allow for privilege escalation.

IAM Vulnerable's big brother - CloudFoxable

Hey all. IAM Vulnerable is still immensely useful for understanding the basic building blocks of AWS IAM privilege escaltion. However, a few years after making IAM vulnerable, I created CloudFoxable, a CTF style version that teaches you the basics of cloud penetration testing more wholisisticlly. - @sethsec

Intentionally Vulnerable Playground

• CloudFoxable - A Gamified Cloud Hacking Sandbox

Want to chat about IAM-Vulnerable, CloudFox, and CloudFoxable?

Join us on the RedSec discord server

🦊 Currently supported privilege escalation paths: 31

Table of Contents

• IAM Vulnerable
• Recommended Approach
• Detailed Usage Instructions
• Quick Start
  • What resources were just created?
  • How much is this going to cost?
• A Modular Approach
  • Free resource modules
  • Non-free resource modules
• Supported Privilege Escalation Paths
• Other Use Cases
• FAQ

Recommended Approach

1. Select or create an AWS account - Do NOT use an account that has any production resources or sensitive data.
2. Create your vulnerable playground - Use this repo to create the IAM principals and policies that support 31 unique AWS IAM privesc paths.
3. Do your homework - Learn about the 21 original privesc paths pioneered by Spencer Gietzen.
4. Hacky, hack - Practice exploitation in your new playground using Gerben Kleijn's guide.
5. Level up - Run your tools against your new IAM privesc playground account (i.e., Cloudsplaining, AWSPX, Principal Mapper, Pacu).

Detailed Usage Instructions

Blog Post: IAM Vulnerable - An AWS IAM Privilege Escalation Playground

Quick Start

This quick start outlines an opinionated approach to getting IAM Vulnerable up and running in your AWS account as quickly as possible. You might have many of these steps already completed, or you might want to tweak things to work with your current configuration. Check out the Other Use Cases section in this repository for some additional configuration options.

1. Select or create an AWS account. (Do NOT use an account that has any production resources or sensitive data!)
2. Create a non-root user with administrative access that you will use when running Terraform.
3. Create an access key for that user.
4. Install the AWS CLI.
5. Configure your AWS CLI with your newly created admin user as the default profile.
6. Confirm your CLI is working as expected by executing aws sts get-caller-identity.
7. Install the Terraform binary and add the binary location to your path.
8. git clone https://github.com/BishopFox/iam-vulnerable
9. cd iam-vulnerable/
10. terraform init
11. (Optional) export TF_VAR_aws_local_profile=PROFILE_IN_AWS_CREDENTIALS_FILE_IF_OTHER_THAN_DEFAULT
12. (Optional) export TF_VAR_aws_local_creds_file=FILE_LOCATION_IF_NON_DEFAULT
13. (Optional) terraform plan
14. terraform apply
15. (Optional) Add the IAM vulnerable profiles to your AWS credentials file, and change the account number.
    • The following commands make a backup of your current AWS credentials file, then takes the example credentials file from the repo and replaces the placeholder account with your target account number, and finally adds all of the IAM Vulnerable privesc profiles to your credentials file so you can use them:
    • cp ~/.aws/credentials ~/.aws/credentials.backup
    • tail -n +7 aws_credentials_file_example | sed s/111111111111/$(aws sts get-caller-identity | grep Account | awk -F\" '{print $4}')/g >> ~/.aws/credentials

Cleanup

Whenever you want to remove all of the IAM Vulnerable-created resources, you can run these commands:

1. cd iam-vulnerable/
2. terraform destroy

Alternative Cleanup (When Terraform State is Lost)

In a case where you have deployed iam-vulnerable using Terraform but no longer have access to the state file (and terraform destroy does not work), you can use the following cleanup scripts:

# Python version (requires boto3)
./cleanup-scripts/cleanup_iam_vulnerable.py --dry-run

# Bash version (requires AWS CLI and jq)  
./cleanup-scripts/cleanup_iam_vulnerable.sh --dry-run

These scripts will:

• Automatically identify all IAM Vulnerable resources in your AWS account
• Show you exactly what will be deleted before proceeding
• Delete resources in the proper order to avoid dependency conflicts
• Support AWS profiles and provide detailed logging

Important: Always run with --dry-run first to see what would be deleted. See cleanup-scripts/CLEANUP_README.md for detailed usage instructions.

What resources were just created?

The Terraform binary just used your default AWS account profile credentials to create:

• 31 users, roles, and policies each with a unique exploit path to administrative access of the playground account
• Some additional users, groups, roles, and policies that are required to fully realize certain exploit paths
• Some additional users, roles, and policies that test the detection capabilities of other tools

By default, every role created by this Terraform module is assumable by the user or role you used to run Terraform.

• If you'd like Terraform to use a profile other than the default profile, or you'd like to hard-code the assume_role_policy ARN, see Other Use Cases.

How much is this going to cost?

Deploying IAM vulnerable in its default configuration will cost nothing. See the next section to learn how to enable non-default modules that do incur cost, and how much each module will cost per month if you deploy it.

A Modular Approach

IAM Vulnerable groups certain resources together in modules. Some of the modules are enabled by default (the ones that don't have any cost implications), and others are disabled by default (the ones that incur cost if deployed). This way, you can enable specific modules as needed.

For example, when you are ready to play with the exploit paths like ssm:StartSession that involve resources outside of IAM, you can deploy and tear down these resources on demand by uncommenting the module in the iam-vulnerable/main.tf file, and re-running terraform apply: