<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# IAM Privilege Escalation — API Reference

## AWS CLI Commands

### IAM Authorization Data

```bash
# Full account authorization details (users, roles, groups, policies)
aws iam get-account-authorization-details --output json

# Credential report
aws iam generate-credential-report
aws iam get-credential-report --output text --query Content | base64 -d

# List all IAM users
aws iam list-users --query 'Users[].{Name:UserName,Arn:Arn,Created:CreateDate}'

# List all IAM roles
aws iam list-roles --query 'Roles[].{Name:RoleName,Arn:Arn}'
```

### Policy Analysis

```bash
# Get specific policy version
aws iam get-policy --policy-arn POLICY_ARN
aws iam get-policy-version --policy-arn POLICY_ARN --version-id v1

# List policy versions
aws iam list-policy-versions --policy-arn POLICY_ARN

# List attached user policies
aws iam list-attached-user-policies --user-name USER

# List inline user policies
aws iam list-user-policies --user-name USER
aws iam get-user-policy --user-name USER --policy-name POLICY

# List attached role policies
aws iam list-attached-role-policies --role-name ROLE

# Get role trust policy
aws iam get-role --role-name ROLE --query 'Role.AssumeRolePolicyDocument'
```

### IAM Access Analyzer

```bash
# Create analyzer
aws accessanalyzer create-analyzer --analyzer-name my-analyzer --type ACCOUNT

# List findings
aws accessanalyzer list-findings --analyzer-arn ANALYZER_ARN

# Get finding details
aws accessanalyzer get-finding --analyzer-arn ANALYZER_ARN --id FINDING_ID
```

### CloudTrail IAM Events

```bash
# IAM policy changes
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreatePolicyVersion
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=AttachUserPolicy
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=PutUserPolicy
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=UpdateAssumeRolePolicy

# Athena query for IAM events
# SELECT eventtime, eventname, useridentity.arn, requestparameters
# FROM cloudtrail_logs
# WHERE eventsource = 'iam.amazonaws.com'
# AND eventname IN ('CreatePolicyVersion','AttachUserPolicy','PutRolePolicy')
# ORDER BY eventtime DESC LIMIT 100;
```

## boto3 API

### Key Methods

| Method | Description |
|--------|-------------|
| `iam.get_account_authorization_details()` | Full IAM dump |
| `iam.get_policy_version(PolicyArn=, VersionId=)` | Policy document |
| `iam.list_attached_user_policies(UserName=)` | User's managed policies |
| `iam.list_user_policies(UserName=)` | User's inline policies |
| `iam.get_role(RoleName=)` | Role details + trust policy |
| `iam.simulate_principal_policy(PolicySourceArn=, ActionNames=)` | Test permissions |

## Escalation Vector Reference

| Vector ID | Required Permissions | ATT&CK |
|-----------|---------------------|--------|
| CreateNewPolicyVersion | `iam:CreatePolicyVersion` | T1098 |
| AttachUserPolicy | `iam:AttachUserPolicy` | T1098 |
| PutUserPolicy | `iam:PutUserPolicy` | T1098 |
| PassRoleLambda | `iam:PassRole` + `lambda:CreateFunction` + `lambda:InvokeFunction` | T1098 |
| UpdateAssumeRolePolicy | `iam:UpdateAssumeRolePolicy` | T1098 |
| PassRoleEC2 | `iam:PassRole` + `ec2:RunInstances` | T1098 |
