Lion Cipher Lab
Find privilege-escalation paths in your AWS IAM with Cloudsplaining
- Cloud Security
- Intermediate
- ~45 min
- Free · no account required
Why it matters
The permissions you already handed out are an attack surface. AWS IAM privilege escalation is rarely a single magic action — it's a chain: a role is allowed to create a new version of a policy, or attach an admin policy to itself, or pass a powerful role to a service it controls (a Lambda function, an EC2 instance) and inherit that role's power. Reading thousands of actions across dozens of policies by hand to spot those chains is hopeless. Cloudsplaining does it in seconds: it scans the IAM authorization details offline and flags every identity policy that grants a known escalation,…
What you'll learn
- scanning AWS IAM policies for privilege-escalation paths
- reading a Cloudsplaining HTML findings report
- recognizing IAM privesc primitives (CreatePolicyVersion, AttachUserPolicy, PassRole)
- triaging true vs. acceptable risk in IAM findings
- the limits of offline static analysis vs. runtime and boundary controls
Steps in this lab
- What Cloudsplaining is, and when you'd reach for it
- Install Cloudsplaining (pip or pipx — no AWS anything)
- Understand the input — the IAM authorization file
- Create a sample authorization file (the offline path — no account needed)
- Generate the exclusions file (tune out the noise)
- Scan the file and open the HTML report
- Read the findings — what each category actually means
- Triage — true risk vs. acceptable risk
- Fix it — least privilege, kill the wildcards, guard PassRole
- When NOT to lean on it — the limits, and what to pair it with