Skip to content
HackIndex logo

HackIndex

IAM Authenticated Enumeration

2 min read May 24, 2026

IAM enumeration maps what identities exist and what they can do. Run this early — the results drive privilege escalation and lateral movement decisions.

Identify Current Identity

┌──(kali㉿kali)-[~]
└─$ aws sts get-caller-identity --profile $PROFILE 
{
    "UserId": "AIDA...",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/jdoe"
}

Enumerate Allowed Actions

┌──(kali㉿kali)-[~]
└─$ cd enumerate-iam
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ python3 enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY --session-token $AWS_SESSION_TOKEN

Users

┌──(kali㉿kali)-[~]
└─$ aws iam list-users --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws iam list-attached-user-policies --user-name $USER --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws iam list-user-policies --user-name $USER --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws iam list-access-keys --user-name $USER --profile $PROFILE

Roles

┌──(kali㉿kali)-[~]
└─$ aws iam list-roles --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws iam get-role --role-name $ROLE_NAME --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws iam list-attached-role-policies --role-name $ROLE_NAME --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws iam list-role-policies --role-name $ROLE_NAME --profile $PROFILE

Policies

┌──(kali㉿kali)-[~]
└─$ aws iam list-policies --scope Local --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws iam get-policy-version --policy-arn $POLICY_ARN --version-id v1 --profile $PROFILE | jq '.PolicyVersion.Document'
┌──(kali㉿kali)-[~]
└─$ aws iam get-user-policy --user-name $USER --policy-name $POLICY_NAME --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws iam get-role-policy --role-name $ROLE_NAME --policy-name $POLICY_NAME --profile $PROFILE

Permission Boundaries

┌──(kali㉿kali)-[~]
└─$ aws iam get-user --user-name $USER --profile $PROFILE | jq '.User.PermissionsBoundary'
┌──(kali㉿kali)-[~]
└─$ aws iam get-role --role-name $ROLE_NAME --profile $PROFILE | jq '.Role.PermissionsBoundary'

A null result means no boundary — the principal is limited only by their attached policies.

Automated Enumeration with Pacu

┌──(kali㉿kali)-[~]
└─$ run iam__enum_users_roles_policies_groups
┌──(kali㉿kali)-[~]
└─$ run iam__privesc_scan

Key Fields to Review in Policy Documents

When reading policy JSON, focus on:

  • "Action": "*" or "Action": "iam:*" — wildcard permissions

  • "Resource": "*" — applies to all resources

  • "Effect": "Allow" with sts:AssumeRole — role chaining paths

  • "Condition" blocks — check if bypassable

  • PassRole — allows attaching roles to services, common escalation path