# IAM Authenticated Enumeration

> Techniques for enumerating AWS IAM users, roles, groups, and policies using authenticated credentials to map permissions and identify privilege escalation paths.

- **URL:** https://hackindex.io/platforms/aws/enumeration/iam/iam-authenticated-enumeration
- **Path:** AWS > Enumeration > IAM
- **Up:** [IAM](https://hackindex.io/platforms/aws/enumeration/iam.md)
- **Published:** 2026-05-24
- **Updated:** 2026-05-24

IAM enumeration maps what identities exist and what they can do. Run this early: the results drive privilege escalation and lateral movement decisions.

## Identify Current Identity

```bash
aws sts get-caller-identity --profile $PROFILE
# {
#     "UserId": "AIDA...",
#     "Account": "123456789012",
#     "Arn": "arn:aws:iam::123456789012:user/jdoe"
# }
```

## Enumerate Allowed Actions

```bash
cd enumerate-iam
source .venv/bin/activate
python3 enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY --session-token $AWS_SESSION_TOKEN
```

## Users

```bash
aws iam list-users --profile $PROFILE
```

**Attached policies**

```bash
aws iam list-attached-user-policies --user-name $USER --profile $PROFILE
aws iam list-user-policies --user-name $USER --profile $PROFILE
```

**Access keys**

```bash
aws iam list-access-keys --user-name $USER --profile $PROFILE
```

## Roles

```bash
aws iam list-roles --profile $PROFILE
```

**Trust policy and attached policies**

```bash
aws iam get-role --role-name $ROLE_NAME --profile $PROFILE
aws iam list-attached-role-policies --role-name $ROLE_NAME --profile $PROFILE
aws iam list-role-policies --role-name $ROLE_NAME --profile $PROFILE
```

## Policies

**Get policy document**

```bash
aws iam list-policies --scope Local --profile $PROFILE
aws iam get-policy-version --policy-arn $POLICY_ARN --version-id v1 --profile $PROFILE | jq '.PolicyVersion.Document'
```

**Inline policies**

```bash
aws iam get-user-policy --user-name $USER --policy-name $POLICY_NAME --profile $PROFILE
aws iam get-role-policy --role-name $ROLE_NAME --policy-name $POLICY_NAME --profile $PROFILE
```

## Permission Boundaries

```bash
aws iam get-user --user-name $USER --profile $PROFILE | jq '.User.PermissionsBoundary'
aws iam get-role --role-name $ROLE_NAME --profile $PROFILE | jq '.Role.PermissionsBoundary'
```

A `null` result means no boundary: the principal is limited only by their attached policies.

## Automated Enumeration with Pacu

```bash
run iam__enum_users_roles_policies_groups
run iam__privesc_scan
```

## Key Fields to Review in Policy Documents

When reading policy JSON, focus on:

- `"Action": "*"` or `"Action": "iam:*"`: wildcard permissions
- `"Resource": "*"`: applies to all resources
- `"Effect": "Allow"` with `sts:AssumeRole`: role chaining paths
- `"Condition"` blocks: check if bypassable
- `PassRole`: allows attaching roles to services, common escalation path