iam:PassRole + Lambda Privilege Escalation

iam:PassRole lets a principal hand an existing role to an AWS service. Combined with lambda:CreateFunction and a way to invoke the function, an attacker can create a Lambda that runs as a far more privileged role, then execute code with that role’s permissions.

Permissions an attacker needs

• iam:PassRole
• lambda:CreateFunction
• lambda:InvokeFunction or lambda:CreateEventSourceMapping

How the escalation works

• The attacker enumerates roles they are allowed to pass and picks a privileged one (for example a role with AdministratorAccess).
• They create a Lambda function, passing that privileged role as the execution role.
• They invoke the function (directly, or via an event source such as a DynamoDB stream). The function code runs with the privileged role’s permissions.

Example vulnerable policy

A policy like this grants the dangerous permission. Paste your own policy into the free AI-Powered IAM analyzer to see if you are exposed.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole",
        "lambda:CreateFunction",
        "lambda:InvokeFunction"
      ],
      "Resource": "*"
    }
  ]
}

Example exploitation

For illustration only — run against accounts you own or are authorized to test.

aws lambda create-function \
  --function-name esc \
  --runtime nodejs20.x --handler index.handler \
  --role arn:aws:iam::123456789012:role/privileged-role \
  --zip-file fileb://function.zip
aws lambda invoke --function-name esc out.json

How to detect and prevent it

• Scope iam:PassRole to specific role ARNs the principal legitimately needs, never Resource "*".
• Add the iam:PassedToService condition (for example lambda.amazonaws.com) so a role can only be passed to the intended service.
• Keep highly privileged execution roles out of reach of PassRole grants; least-privilege the execution roles themselves.

FAQ

Related escalation methods

• iam:PassRole + EC2 RunInstances Privilege Escalation
• iam:AttachUserPolicy Privilege Escalation
• iam:UpdateAssumeRolePolicy Privilege Escalation

Amazon Web Services (AWS) is a trademark of Amazon.com, Inc. Shieldly is not affiliated with, endorsed by, or sponsored by Amazon Web Services.