# Cloud Security Bypass

> Enumerate AWS IAM, steal credentials via SSRF to IMDS, escalate through PassRole plus Lambda, and abuse OIDC federation to assume roles from outside the account.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/cloud-security-bypass
- **Certification:** [PT2 (Penetration Tester Level 2) Study Path](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path.md)
- **Estimated study hours:** 10
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

Cloud environments move the attack surface from kernel and network to API and IAM policy. The exam rewards treating AWS as a graph of principals, roles, and trust policies: enumerate what you can see, find the one permission that unlocks the next role, and chain assume-role calls until a role with the sensitive access is yours. PT2 tests one cloud (AWS) in depth; the primitives (IMDS, metadata, trust policy, PassRole) have direct equivalents on GCP and Azure.

## Credential Discovery

Every AWS compromise starts with a credential. Long-term access keys leaked in Git, S3 buckets, environment variables, or build artefacts. Temporary session credentials from IMDS on a compromised EC2 instance. Role credentials from an SSRF against the instance metadata endpoint at `169.254.169.254`. Web identity tokens from a mis-scoped OIDC trust. The credential resolution chain (env vars → shared credentials file → container role → instance role) explains why one leaked value often implicates several roles.

## Enumeration

Unauthenticated: account ID leaks from public S3 buckets, AMIs, ECR repos, and `sts:AssumeRole` error messages. Role name enumeration via SSH-style error discrimination. Authenticated: `get-caller-identity`, then enumerate every IAM entity you can touch. Lambda function listings expose environment variables (frequently used for secrets injection) and execution roles. Secrets Manager and SSM Parameter Store hold credentials, API keys, and connection strings scoped by key name alone.

## IMDS And SSRF Chains

SSRF against a web application on EC2 reaches the metadata service. IMDSv1 responds without any header; IMDSv2 requires a PUT to get a token first, trivially bypassed when the SSRF supports PUT or when the request pipeline sets the token header itself. The response gives you the role's short-lived credentials, which inherit everything the role is attached to.

## Privilege Escalation

IAM has a dozen escalation primitives. The classic: `iam:PassRole` + `lambda:CreateFunction` + `lambda:InvokeFunction` → attach a higher-privilege role to a Lambda you write, invoke it, run arbitrary code as that role. Equivalent paths for EC2, CodeBuild, Glue, and ECS. Writeable managed-policy versions, misconfigured `sts:AssumeRole` trust policies with wildcard principals, and over-permissive permission boundaries all collapse to privilege escalation.

## OIDC Federation

Trust policies that federate to external identity providers (GitHub Actions, EKS IRSA, generic OIDC) often fail to pin the subject claim precisely. If you can mint an OIDC token with a matching subject (your own GitHub repo named after the trusted one, a forked workflow, an IRSA service account you can create), you assume the role from outside the account entirely, no leaked keys needed.

## Study material

- [AWS Credential Types & Resolution Chain](https://hackindex.io/platforms/aws/setup/aws-credential-types-and-resolution-chain.md) (read, core)
- [AWS Account ID and IAM Discovery](https://hackindex.io/platforms/aws/reconnaissance/aws-account-id-and-iam-discovery.md) (read, core)
- [IAM Unauthenticated Enumeration](https://hackindex.io/platforms/aws/enumeration/iam/iam-unauthenticated-enumeration.md) (read, core)
- [IAM Authenticated Enumeration](https://hackindex.io/platforms/aws/enumeration/iam/iam-authenticated-enumeration.md) (read, core)
- [EC2 Instance Metadata Service (IMDS)](https://hackindex.io/platforms/aws/enumeration/ec2/ec2-instance-metadata-service.md) (read, core)
- [SSRF to IMDS Credential Theft](https://hackindex.io/platforms/aws/exploitation/ec2/ec2-ssrf-imds-credential-theft.md) (read, core)
- [Lambda Function Enumeration](https://hackindex.io/platforms/aws/enumeration/lambda/lambda-function-enumeration.md) (read, core)
- [Secrets Manager and SSM Parameter Store Enumeration](https://hackindex.io/platforms/aws/enumeration/secrets/secrets-manager-and-ssm-parameter-store-enumeration.md) (read, core)
- [IAM PassRole Lambda Escalation](https://hackindex.io/platforms/aws/privilege-escalation/iam/iam-passrole-lambda-ec2-escalation.md) (read, core)
- [OIDC Federation Abuse](https://hackindex.io/platforms/aws/exploitation/oidc-federation-abuse.md) (read, core)