Cloud Infrastructure
IAM Misconfiguration
Overpermissioned roles are a direct path to full environment compromise.
What it is
Cloud IAM roles and service accounts accumulate permissions over time. AdministratorAccess attached to developer roles, wildcard resource policies in S3, and cross-account trust relationships with excessive permissions are consistently among the most critical cloud findings. Least-privilege IAM is not a one-time setup — it requires continuous review and automated enforcement.
Attack techniques
- Abuse of overpermissioned IAM roles
- Privilege escalation via iam:PassRole (T1078.004)
- AssumeRole chaining
- Cross-account trust exploitation
- Service account key theft
Business impact
An attacker who compromises any workload or service account with excessive permissions can escalate to full administrative access over the entire cloud environment.