Useful IAM tips and security tools

Practical AWS CLI tips

This course requires heavy use of the AWS CLI, and especially aws iam commands. You’ll need to regularly refer to documentation but another tip is to use grep in order to search through the help menu, like this:

aws iam help | grep -e "list-group" -e "get-group"
       o get-group
       o get-group-policy
       o list-group-policies
       o list-groups
       o list-groups-for-user

That way you can save a lot of time instead of constantly going back and forth with docs.

About using tools/automation for this course

You do not need any of the tools in this lesson in order to successfully complete the labs in this course! Every single one of them can be 100% accomplished using the AWS CLI, and that’s how I recommend that you do it the first time around to get experience with using the AWS CLI.

With that said, if you’re already experienced or if you’ve already gone through a first run, trying out these automation tools is also a great idea as they can help speed things up and/or find issues you may not have manually found.

Also, please note that while I have personally used and continue to use some of these tools, I’ve also included some that I have heard about but haven’t personally (or thoroughly) tested, so they may not work as intended. Especially since some of them are a few years old and haven’t been recently updated. If that’s the case, please drop me a comment below and I’ll remove the tool. (I ultimately want to test them all, just haven’t had the time yet)

IAMActionHunter

https://github.com/RhinoSecurityLabs/IAMActionHunter

Quickly and easily evaluate one or more IAM policies to find issues.

This is a tool you can use to more quickly understand what the vulnerability might be across one policy or across multiple policies.

IAMFinder

https://github.com/prisma-cloud/IAMFinder

IAMFinder enumerates and finds users and IAM roles in a target AWS account.

EnumerateIAM

https://github.com/andresriancho/enumerate-iam

Enumerate the permissions associated with an AWS credential set. This tool tries to brute force all API calls allowed by the IAM policy. The calls performed by this tool are all non-destructive (only get* and list* calls are performed). Great for finding weaknesses you may not have manually found.

aws_escalate.py

https://github.com/RhinoSecurityLabs/Security-Research/blob/master/tools/aws-pentest-tools/aws_escalate.py

A script that can help you find privesc paths.

Pacu

https://github.com/RhinoSecurityLabs/pacu

Pacu is an open-source AWS exploitation framework, designed for offensive security testing against cloud environments. Pacu allows penetration testers to exploit configuration flaws within an AWS account, using modules to easily expand its functionality. This is the same tool we demonstrate in our Pentesting AWS Environments with Pacu, CloudGoat, and ChatGPT course

ScoutSuite, Prowler, etc…

There are also larger tools like ScoutSuite and Prowler that can scan environment to audit them, and that includes finding IAM misconfigurations, so it can be helpful in this sort of situation. A quick note: I don’t think ScoutSuite is being maintained anymore so your mileage may vary.

Any other tools we should add?

There are many other AWS security tools out there, but I tried only adding lightweight and open-source tools. If you have other tools you’d recommend adding to this list that fit that criteria and that’s specific to IAM, let me know in the comments below!