aws-iam-enum
Enumerate AWS IAM policies, detect privilege escalation paths per Rhino Security Labs canonical 21 primitives.
Best for Security engineersWorks with GitHub
⌘source
- author
@PurpleAILAB- language
- Python
★2.1kstars
366forks
Apr 18, 2026
✦overview.md
Key Features
- ·Enumerates attached and inline IAM policies for a user
- ·Detects privilege escalation paths based on Rhino Security Labs' 21 primitives
- ·Provides specific AWS CLI commands for identity and policy retrieval
- ·Lists common high-risk IAM actions like CreateAccessKey and PassRole combinations
Use Cases
- →Auditing your own IAM permissions for security vulnerabilities
- →Identifying potential privilege escalation risks in a compromised AWS account
- →Reviewing IAM policies during security assessments or penetration tests
Best for
- ✓Security engineers
- ✓Cloud penetration testers
- ✓DevOps teams auditing permissions
Not ideal for
- !Managing IAM policies
- !Automated compliance reporting
- !Real-time monitoring
FAQs
name
aws-iam-enum
description
Enumerate AWS IAM policies, detect privilege escalation paths per Rhino Security Labs canonical 21 primitives.
AWS IAM Enumeration + Privesc
1. Identity check
aws sts get-caller-identity
aws iam get-account-summary
2. Attached policies
aws iam list-attached-user-policies --user-name ME --output json > /tmp/attached.json
aws iam list-user-policies --user-name ME --output json > /tmp/inline.json
aws iam list-groups-for-user --user-name ME --output json > /tmp/groups.json
For each attached policy ARN:
aws iam get-policy --policy-arn ARN --query 'Policy.DefaultVersionId'
aws iam get-policy-version --policy-arn ARN --version-id VID > /tmp/policy.json
Then:
iam_policy_audit(open("/tmp/policy.json").read())
3. Check each privesc primitive
Rhino Security's canonical 21 paths — any Allow on these is a chain step:
- iam:CreateAccessKey (other user)
- iam:CreateLoginProfile
- iam:UpdateLoginProfile
- iam:AttachUserPolicy / iam:AttachGroupPolicy / iam:AttachRolePolicy
- iam:PutUserPolicy / iam:PutGroupPolicy / iam:PutRolePolicy
- iam:CreatePolicyVersion (if SetAsDefault=true)
- iam:SetDefaultPolicyVersion
- iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction
- iam:PassRole + ec2:RunInstances
$install
1-click copynpx skills add PurpleAILAB/Decepticon --skill aws-iam-enumSafety assessment
★
Clarity score
How clear and easy to understand the SKILL.md instructions are, rated from 1 to 5.
5/ 5
excellentVery clear and well structured, with almost no room for misunderstanding.
◎
Actionability score
How directly an agent can act on the SKILL.md instructions, rated from 1 to 5.
5/ 5
very highHighly actionable with clear, concrete steps that an agent can follow directly.