iam-deceptive-escalation-auditor

iam-deceptive-escalation-auditor

Privilege-escalation audit skill for one AWS IAM principal. Takes every permissions policy attached to a role or user (plus the trust policy and permissions boundary if supplied), resolves the effective permission set across all of them, and answers one question a per-statement read cannot: can this principal escalate to a privilege it was not granted, and is an apparent escalation real or already neutralised. It returns findings with severity and a fix, then names exactly where a single principal's policy documents stop being able to answer the question.

The escalation combinations this skill exists to catch are precisely the ones that span two statements or two attached policies, so that no single statement looks guilty on its own. iam:PassRole in one policy and sagemaker:CreateTrainingJob in another are each routine; together they let the principal launch compute with any role attached and inherit it. A per-statement read clears every statement and misses the union. The other half of the skill is the inverse discipline: an explicit Deny, a resource scope, a broken trust, or an unsatisfiable Condition can neutralise an escalation that still reads as critical, and the audit must not fabricate a finding the effective permissions do not support.

When to invoke

• An agent is asked to audit an IAM role or user for privilege escalation, over-broad grants, or "can this principal become administrator."
• A policy is being shipped or reviewed and the question is whether two individually-fine grants combine into an escalation.
• A policy looks dangerous (a full mutation kit, a cross-account assume, an Action '*') and the claim "but it's capped / scoped / denied" needs to be confirmed against the effective permissions, not taken on trust.
• An incident assumes a principal is compromised and the question is what it can escalate to.

What this skill reads, and what it does not

It reads the static policy documents attached to one principal: every permissions policy, plus the trust policy (AssumeRolePolicyDocument) and the permissions boundary if supplied. That is the entire input. The audit is correct and complete for the effective permissions those documents express, and it is explicit about the rest. Every audit ends by naming the joins it cannot make: