Exploiting, detecting, and correcting IAM security misconfigurations

Bad Actor

Identity and access management (IAM) misconfigurations are one of the most common concerns in cloud security. Over the past few years, these security holes have put organizations at increased risk of experiencing serious attacks to their cloud accounts.

To some, cloud environments might look like a safe place, where security is set by default. However, the truth is that security follows a shared responsibility model. For example, you are in charge of securing AWS console access.

However, what if a misconfiguration over your users or roles is applied in your environment? Attackers can use them to gain the keys to the kingdom, accessing your environment and creating serious damage. In scenarios where attackers are already in, misconfigurations can help them perform cloud lateral movement [1], exfiltrate sensitive data, or use the account for their own purpose (e.g., crypto mining [2]).

In this article, I put security best practices aside and have some fun focusing attention on real-world scenarios of IAM security misconfigurations. I'll showcase how it would be possible for an attacker to use those IAM misconfigurations and create serious hassles.

Big Deal?

AWS IAM [3] lets you manage access to AWS services and resources securely. With IAM, you can create and granularly manage AWS users and groups and use permissions to allow and deny them access to AWS resources.

From this definition of IAM, you can easily agree that this piece of infrastructure needs your focus. If this service is misconfigured, users or groups might cause huge damage to your infrastructure.

The fine granularity of permissions available in cloud environments allows the application of the least privileges concept

...

Use Express-Checkout link below to read the full article (PDF).