Lion Cipher Lab
Map AWS IAM privilege-escalation attack paths as a graph with PMapper — then close the edge
- Cloud Security
- Advanced
- ~75 min
- Free · no account required
Why it matters
Real privilege escalation in AWS is rarely one bad policy — it is a chain no single policy reveals. Alice cannot administer the account. But Alice can assume deploy-role; deploy-role can pass admin-role to a Lambda function it creates and invokes; that Lambda now runs AS admin-role. Three ordinary, individually-defensible grants compose into a path to full control. Per-policy scanners like Cloudsplaining flag the primitives, but they read each policy alone and cannot see that these principals CONNECT. The only way to see the chain is to model the whole account as a directed graph — nodes are…
What you'll learn
- modeling an AWS account as a directed IAM authorization graph
- reasoning about MULTI-HOP / transitive privilege escalation across principals
- running PMapper (graph create, query, argquery, visualize) against a local account
- reading a preset-privesc result and tracing the exact edges of an attack path
- closing an attack path by removing ONE edge and re-proving it is gone
- knowing PMapper's model limits (SCPs, permission boundaries, resource/session policies) and its named failure modes
Steps in this lab
- Why single-policy scanning misses transitive escalation
- What PMapper is — and how it sits ABOVE the Cloudsplaining lab
- Install the tools — Docker, LocalStack, PMapper
- Stand up the deliberately-vulnerable principals in LocalStack
- Build the graph — `pmapper graph create`
- Query the graph — who can reach admin, and by what path
- Close the edge — remove ONE permission and re-prove the path is gone
- Judgment — model limits, false paths, and the offense/defense duality