Multicloud IAM & Privilege Escalation Audit Playbook

Status: Draft — Samer's Field Audit Playbook
Curriculum synthesis derived from SANS SEC559 (Identity Security for Cloud & Hybrid) and SANS SEC510 (Cloud Security Controls & Mitigations).

Executive Objective

In modern cloud environments, Identity is the true network perimeter.

During external audits (SOC 2 CC6, ISO 27001 A.8.2, and DORA Pillar I), auditors require verified evidence that:

1. No unmanaged administrative credentials or inactive accounts exist.
2. Cross-account role assumption is strictly constrained by external IDs and conditions.
3. Compute workloads (EC2, Lambda, VMs) cannot be abused to escalate privileges via the cloud metadata service.

Use this walkthrough to conduct a structured IAM audit on any client cloud tenant.

Tooling Prerequisites

Install and configure these open-source cloud auditing tools in your testing environment:

# 1. AWS Official CLI
aws --version

# 2. CloudFox (Finds exploitable attack paths in cloud environments)
brew install cloudfox # or download binary from github.com/BishopFox/cloudfox

# 3. Prowler (Comprehensive security baseline & compliance scanner)
pip install prowler

Step 1: Auditing Cloud Administrator Blast Radius & Inactive Keys

1.1 Generate the AWS Credential Report

The credential report provides an authoritative snapshot of every IAM user, password state, MFA status, and access key age.

# Generate the report
aws iam generate-credential-report

# Download and parse active users without MFA
aws iam get-credential-report --output text --query Content | base64 -d | cut -d, -f1,4,8,9 | column -t -s,

1.2 Identify Unrotated Access Keys Older Than 90 Days

aws iam list-users --query 'Users[*].UserName' --output text | tr '\t' '\n' | while read user; do
  aws iam list-access-keys --user-name "$user" --query 'AccessKeyMetadata[?Status==`Active`].[UserName,AccessKeyId,CreateDate]' --output text
done

Step 2: Automated Privilege Escalation Path Discovery (CloudFox)

Using CloudFox, map all principals that can escalate to administrator permissions through permission combinations such as iam:PassRole + ec2:RunInstances or iam:CreatePolicyVersion.

# Discover privilege escalation paths across the entire AWS account
cloudfox aws --profile client-audit permissions --principal all

# Identify all IAM roles attached to public-facing compute instances
cloudfox aws --profile client-audit roles

Step 3: Verifying Instance Metadata Service (IMDSv2) Enforcement

The Vulnerability: IMDSv1 permits unauthenticated HTTP GET requests to http://169.254.169.254/latest/meta-data/iam/security-credentials/, allowing Server-Side Request Forgery (SSRF) web vulnerabilities to steal instance IAM role tokens (e.g. Capital One incident).

The Audit Check: Confirm all EC2 instances strictly require IMDSv2 session tokens:

# Find EC2 instances still permitting IMDSv1
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[?MetadataOptions.HttpTokens!=`required`].[InstanceId,Tags[?Key==`Name`].Value | [0],MetadataOptions.HttpTokens]' \
  --output table

Remediation Command to Hand to Engineering:

# Enforce IMDSv2 and restrict hop limit to 1 (blocks container breakout to host metadata)
aws ec2 modify-instance-metadata-options \
  --instance-id <INSTANCE_ID> \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled

Step 4: Auditor Evidence Checklist

When documenting findings for external certification audits, compile these artifacts into your evidence folder: