The 31 iam-vulnerable privilege-escalation paths
The BishopFox iam-vulnerable project documents 31 AWS IAM privilege-escalation paths, one Terraform file per path. This page lists exactly those 31, the actions each policy grants, and whether audytx detected each one on our last measured run. The project's README credits its 21 original paths to research published by Rhino Security Labs.
How to read the table
- Path is the upstream name of the scenario.
- Actions are the key permissions in that scenario's policy. Read-only helper permissions are left out.
- Detected means audytx reported an IAM privilege-escalation finding on that scenario's Terraform file in the measured run.
The 31 paths
| # | Path | Actions | Detected |
|---|---|---|---|
| IAM Permissions on Other Users (3) | |||
| 01 | IAM-CreateAccessKey | iam:CreateAccessKey | Yes |
| 02 | IAM-CreateLoginProfile | iam:CreateLoginProfile | Yes |
| 03 | IAM-UpdateLoginProfile | iam:UpdateLoginProfile | Yes |
| PassRole to Service (10) | |||
| 04 | CloudFormation-PassExistingRoleToCloudFormation | iam:PassRole, cloudformation:CreateStack | Yes |
| 05 | CodeBuild-CreateProjectPassRole | iam:PassRole, codebuild:CreateProject, codebuild:StartBuild, codebuild:StartBuildBatch | Yes |
| 06 | DataPipeline-PassExistingRoleToNewDataPipeline | iam:PassRole, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition, datapipeline:ActivatePipeline | Yes |
| 07 | EC2-CreateInstanceWithExistingProfile | iam:PassRole, ec2:RunInstances | Yes |
| 08 | Glue-PassExistingRoleToNewGlueDevEndpoint | iam:PassRole, glue:CreateDevEndpoint | Yes |
| 09 | Lambda-PassExistingRoleToNewLambdaThenInvoke | iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction | Yes |
| 10 | Lambda-PassRoleToNewLambdaThenTrigger | iam:PassRole, lambda:CreateFunction, lambda:CreateEventSourceMapping | Yes |
| 11 | SageMaker-CreateNotebookPassRole | iam:PassRole, sagemaker:CreateNotebookInstance | Yes |
| 12 | SageMaker-CreateTrainingJobPassRole | iam:PassRole, sagemaker:CreateTrainingJob | Yes |
| 13 | SageMaker-CreateProcessingJobPassRole | iam:PassRole, sagemaker:CreateProcessingJob | Yes |
| Permissions on Policies (9) | |||
| 14 | IAM-AddUserToGroup | iam:AddUserToGroup | Yes |
| 15 | IAM-AttachGroupPolicy | iam:AttachGroupPolicy | Yes |
| 16 | IAM-AttachRolePolicy | iam:AttachRolePolicy | Yes |
| 17 | IAM-AttachUserPolicy | iam:AttachUserPolicy | Yes |
| 18 | IAM-CreateNewPolicyVersion | iam:CreatePolicyVersion | Yes |
| 19 | IAM-PutGroupPolicy | iam:PutGroupPolicy | Yes |
| 20 | IAM-PutRolePolicy | iam:PutRolePolicy | Yes |
| 21 | IAM-PutUserPolicy | iam:PutUserPolicy | Yes |
| 22 | IAM-SetExistingDefaultPolicyVersion | iam:SetDefaultPolicyVersion | Yes |
| Privilege Escalation using AWS Services (8) | |||
| 23 | EC2InstanceConnect-SendSSHPublicKey | ec2-instance-connect:SendSSHPublicKey | Yes |
| 24 | CloudFormation-UpdateStack | cloudformation:UpdateStack | Yes |
| 25 | Glue-UpdateExistingGlueDevEndpoint | glue:UpdateDevEndpoint | Yes |
| 26 | Lambda-EditExistingLambdaFunctionWithRole | lambda:UpdateFunctionCode | Yes |
| 27 | SageMakerCreatePresignedNotebookURL | sagemaker:CreatePresignedNotebookInstanceUrl | Yes |
| 28 | SSM-SendCommand | ssm:SendCommand | Yes |
| 29 | SSM-StartSession | ssm:StartSession | Yes |
| 30 | STS-AssumeRole | sts:AssumeRole along a role chain that ends in a full-access policy | Yes |
| Updating an AssumeRole Policy (1) | |||
| 31 | IAM-UpdatingAssumeRolePolicy | iam:UpdateAssumeRolePolicy, sts:AssumeRole | Yes |
Measured on 2026-08-07 with engine 1.18.276 against the iam-vulnerable repository at commit 0f29866: 31 of 31 paths detected. The result is dated and is not re-measured on every release. Action lists come from the policy files in that repository.
Frequently asked questions
Does audytx flag iam:PassRole on its own?
Yes, when the grant is on all resources (Resource: "*"), has no condition and nothing denies it: iam:PassRole is then treated as an escalation-capable permission by itself. Where context shows a finding is harmless, audytx holds it back and prints the reason.
Is this every AWS IAM privilege-escalation path?
No. It is the 31 paths in the iam-vulnerable project, which is a fixed list. AWS adds services over time, and a path that is not on this list is not covered by this measurement.
Catch these on the pull request
Install the GitHub App and audytx reviews your next Terraform change for the paths it detects. The Free plan includes 100 scans a month.