AWS IAM Privilege Escalation: Methods, Examples, and Fixes

Privilege escalation in AWS IAM happens when a principal has just enough permission to grant itself more. The paths below are the most common ones — each turns a narrowly-scoped permission into administrator-level access. Every method has a dedicated page with an example vulnerable policy, an illustration of the attack, and the fix.

Want to know if your policies contain any of these? Paste a policy into the free AI-Powered IAM analyzer — no signup, no AWS credentials.

New to the terminology? The AWS IAM glossary defines trust policies, permissions boundaries, condition keys, and the other concepts these escalations rely on. Want all of them on one scannable page? See the IAM privilege escalation cheat sheet. Writing a new policy instead of auditing one? See the IAM policy template library for scoped, copy-paste starting points.

Escalation methods

iam:CreatePolicyVersionCritical

iam:CreatePolicyVersion Privilege Escalation

iam:SetDefaultPolicyVersionHigh

iam:SetDefaultPolicyVersion Privilege Escalation

iam:AttachUserPolicyCritical

iam:AttachUserPolicy Privilege Escalation

iam:PutUserPolicyCritical

iam:PutUserPolicy Privilege Escalation

iam:AddUserToGroupHigh

iam:AddUserToGroup Privilege Escalation

iam:CreateAccessKeyHigh

iam:CreateAccessKey Privilege Escalation

iam:CreateLoginProfile / iam:UpdateLoginProfileHigh

iam:CreateLoginProfile and UpdateLoginProfile Privilege Escalation

iam:PassRole + lambda:CreateFunctionCritical

iam:PassRole + Lambda Privilege Escalation

iam:PassRole + ec2:RunInstancesCritical

iam:PassRole + EC2 RunInstances Privilege Escalation

iam:UpdateAssumeRolePolicy + sts:AssumeRoleCritical

iam:UpdateAssumeRolePolicy Privilege Escalation

lambda:UpdateFunctionCodeHigh

lambda:UpdateFunctionCode Privilege Escalation

iam:PassRole + glue:CreateDevEndpointCritical

iam:PassRole + Glue Dev Endpoint Privilege Escalation

iam:PassRole + cloudformation:CreateStackCritical

iam:PassRole + CloudFormation Privilege Escalation

iam:PassRole + sagemaker:CreateNotebookInstanceCritical

iam:PassRole + SageMaker Notebook Privilege Escalation

iam:PassRole + codebuild:CreateProjectCritical

iam:PassRole + CodeBuild Privilege Escalation

iam:PassRole + datapipeline:CreatePipelineHigh

iam:PassRole + Data Pipeline Privilege Escalation

iam:UpdateLoginProfileCritical

iam:UpdateLoginProfile Privilege Escalation

iam:AttachRolePolicyCritical

iam:AttachRolePolicy Privilege Escalation

iam:AttachGroupPolicyCritical

iam:AttachGroupPolicy Privilege Escalation

iam:PutRolePolicyCritical

iam:PutRolePolicy Privilege Escalation

iam:PutGroupPolicyCritical

iam:PutGroupPolicy Privilege Escalation

iam:PassRole + ecs:RunTaskCritical

iam:PassRole + ECS Privilege Escalation

iam:PassRole + ec2:ReplaceIamInstanceProfileAssociationCritical

EC2 Instance Profile Swap Privilege Escalation

ssm:SendCommandHigh

ssm:SendCommand Privilege Escalation

iam:PassRole + lambda:CreateFunction + lambda:CreateEventSourceMappingCritical

Lambda Event Source Mapping Privilege Escalation

ec2:ModifyInstanceAttributeCritical

ec2:ModifyInstanceAttribute User Data Privilege Escalation

Looking for the wider ecosystem? We maintain awesome-aws-iam-security on GitHub — a curated, vendor-neutral list of AWS IAM security tools (open source and commercial, including alternatives to Shieldly), attack catalogs, and research.

Scan your IAM policies free

Shieldly's AI-Powered analyzer flags privilege-escalation paths, wildcards, and risky PassRole in seconds. No signup, no AWS credentials. Also ships as CLI, VS Code extension, GitHub Action, and CDK Guard.

Amazon Web Services (AWS) is a trademark of Amazon.com, Inc. Shieldly is not affiliated with, endorsed by, or sponsored by Amazon Web Services.