IAMActionHunter: an IAM policy statement parser and query tool


IAMActionHunter is an IAM policy statement parser and query tool that aims to simplify the process of collecting and understanding permission policy statements for users and roles in AWS Identity and Access Management (IAM). Although its functionality is straightforward, this tool was developed in response to the need for an efficient solution during day-to-day AWS penetration testing.

Offensive Use

The tool can be utilized to search for potential privilege escalation opportunities in AWS accounts by querying various AWS IAM actions that might be exploited. While other tools perform scans to identify privilege escalation risks, this tool enables a more manual approach, allowing users to investigate permissions and quickly review the roles, users, and resources they apply to for targeted analysis.

Blue Team Use

This tool also offers the ability to output and save query results in a CSV format, which is beneficial for security teams seeking a high-level overview of principal permissions and resources within an AWS account. For instance, you may want to identify users and roles with iam:put* permissions in an account. By executing a query and generating a CSV, you can easily review all users and roles with these permissions, along with the resources they have access to.


pip3 install iamactionhunter

Much of this functionality has also been implemented into https://github.com/RhinoSecurityLabs/pacu as a module, iam__enum_action_query if you prefer that.



First download all IAM info for users and roles:
iamactionhunter –collect –profile my-aws-profile

List any account data has been collected for:
iamactionhunter –list

Then query something:
iamactionhunter –account <account_number_of_profile_above> –query iam:create*

Then query more:
iamactionhunter –account <account_number_of_profile_above> –query iam:create*,iam:put*

Query a particular role:
iamactionhunter –account <account_number_of_profile_above> –role some_role –query iam:*

Query a particular user:
iamactionhunter –account <account_number_of_profile_above> –user some_user –query iam:*

Output to a CSV:
iamactionhunter –account <account_number_of_profile_above> –query iam:* –csv report.csv

Run a preset config:
iamactionhunter –account <account_number_of_profile_above> –config dangerous_iam

Run a query which only shows the results if a user or role has all queried permissions:
iamactionhunter –account <account_number_of_profile_above> –query s3:getobject,s3:listbucket –all-or-none

Copyright (C) 2023 RhinoSecurityLabs

Source: https://github.com/RhinoSecurityLabs/