AWS IAM privilege escalation detection in Terraform

What IAM privilege escalation is in Terraform

IAM privilege escalation happens when a principal with limited permissions can acquire additional privileges by chaining a sequence of API calls — attaching a policy, assuming a role, passing a role to a service, or calling a privileged service like Lambda or EC2. In Terraform, these chains are visible in the configuration: an aws_iam_role_policy grants iam:PassRole, an aws_lambda_function references that role, and a trust policy allows the principal to assume it. Detecting the path requires reading all three resources together.

The 31 documented IAM privilege-escalation paths — all detected

From the BishopFox iam-vulnerable corpus — 31 documented AWS IAM privilege-escalation paths, one Terraform file per path. audytx detects all 31. Organized below by escalation vector.

Benchmark: audytx vs Checkov, Trivy, KICS on iam-vulnerable

Corpus: BishopFox iam-vulnerable · 31 documented paths · one Terraform file per path. Full methodology and raw data: audytx benchmark page.

A worked example: PassRole privilege escalation in Terraform

How a three-file configuration creates an IAM privilege-escalation path that pattern matching misses.

# iam_role_developer.tf
resource "aws_iam_role" "developer" {
  name = "developer-role"
}

resource "aws_iam_role_policy" "developer_policy" {
  role = aws_iam_role.developer.id
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = ["lambda:InvokeFunction", "iam:PassRole"]
      Resource = "*"
    }]
  })
}

# lambda.tf
resource "aws_lambda_function" "updater" {
  function_name = "config-updater"
  role          = aws_iam_role.admin.arn  # ← receives the passed role
}

resource "aws_iam_role" "admin" {
  name = "admin-role"
}

resource "aws_iam_role_policy_attachment" "admin_policy" {
  role       = aws_iam_role.admin.name
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

A pattern matcher scanning only iam_role_policy sees iam:PassRole as a potential concern but can't confirm the target role is privileged without reading iam_role_policy_attachment. audytx resolves the full chain across all three resources.

IAM security rules in audytx

audytx's IAM engine covers both direct misconfigurations and cross-resource attack paths. Rules fire when the configuration provides enough information to reason about them — missing attributes produce Incomplete (no false alarm from partial config).

See the full IAM rule inventory on the features page and the raw benchmark data on the comparison page.