IAMActionHunter: an IAM policy statement parser and query tool
IAMActionHunter
IAMActionHunter is an IAM policy statement parser and query tool that aims to simplify the process of collecting and understanding permission policy statements for users and roles in AWS Identity and Access Management (IAM). Although its functionality is straightforward, this tool was developed in response to the need for an efficient solution during day-to-day AWS penetration testing.
Offensive Use
The tool can be utilized to search for potential privilege escalation opportunities in AWS accounts by querying various AWS IAM actions that might be exploited. While other tools perform scans to identify privilege escalation risks, this tool enables a more manual approach, allowing users to investigate permissions and quickly review the roles, users, and resources they apply to for targeted analysis.
Blue Team Use
This tool also offers the ability to output and save query results in a CSV format, which is beneficial for security teams seeking a high-level overview of principal permissions and resources within an AWS account. For instance, you may want to identify users and roles with iam:put* permissions in an account. By executing a query and generating a CSV, you can easily review all users and roles with these permissions, along with the resources they have access to.
Installation
pip3 install iamactionhunter
Much of this functionality has also been implemented into https://github.com/RhinoSecurityLabs/pacu as a module, iam__enum_action_query if you prefer that.
Use
Examples
First download all IAM info for users and roles:
iamactionhunter –collect –profile my-aws-profile
List any account data has been collected for:
iamactionhunter –list
Then query something:
iamactionhunter –account <account_number_of_profile_above> –query iam:create*
Then query more:
iamactionhunter –account <account_number_of_profile_above> –query iam:create*,iam:put*
Query a particular role:
iamactionhunter –account <account_number_of_profile_above> –role some_role –query iam:*
Query a particular user:
iamactionhunter –account <account_number_of_profile_above> –user some_user –query iam:*
Output to a CSV:
iamactionhunter –account <account_number_of_profile_above> –query iam:* –csv report.csv
Run a preset config:
iamactionhunter –account <account_number_of_profile_above> –config dangerous_iam
Run a query which only shows the results if a user or role has all queried permissions:
iamactionhunter –account <account_number_of_profile_above> –query s3:getobject,s3:listbucket –all-or-none
Copyright (C) 2023 RhinoSecurityLabs
