<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-cloud-identity-permissions
description: >-
  Audit cloud IAM roles, policies, and service accounts across AWS, GCP, and
  Azure for excessive permissions, privilege escalation paths, unused roles,
  cross-account trust, and policy drift using IAM Access Analyzer, ScoutSuite,
  and custom audit scripts.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - iam
  - rbac
  - privilege-escalation
  - aws-iam
  - gcp-iam
  - azure-ad
  - access-analyzer
  - least-privilege
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004"]
---

# Auditing Cloud Identity Permissions

## Overview

Cloud IAM misconfigurations are the top attack vector for cloud breaches.
This skill audits IAM policies for wildcard permissions, unused roles,
overly permissive trust relationships, and privilege escalation paths
across AWS, GCP, and Azure.

Mode: `[MODE: RED]` — IAM privilege escalation enumeration. `[MODE: BLUE]` — IAM audit and hardening.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI with SecurityAudit or IAMReadOnlyAccess | Required |
| gcloud CLI with iam.roles.list permission | Required |
| az CLI with Reader role | Required |

## Key Concepts

### AWS IAM Audit

```bash
# Full IAM authorization details
aws iam get-account-authorization-details --output json > iam-details.json

# Find wildcard policies
aws iam get-account-authorization-details --output json | \
  jq '.Policies[].PolicyVersionList[].Document.Statement[] | select(.Effect == "Allow" and (.Action | type == "array" and any(. == "*") or . == "*"))'

# Unused access keys (>90 days)
aws iam generate-credential-report
aws iam get-credential-report --output json | \
  jq -r '.Content' | base64 -d | csvtool col 1,4,5,9,11 -

# IAM Access Analyzer
aws accessanalyzer create-analyzer --analyzer-name org-analyzer --type ACCOUNT
aws accessanalyzer list-findings --analyzer-arn ARN --output json

# Find roles assumable by external accounts
aws iam list-roles --output json | \
  jq '.Roles[] | select(.AssumeRolePolicyDocument.Statement[].Principal.AWS // "" | test("arn:aws:iam::[0-9]+:root"))'

# Simulate permissions
aws iam simulate-principal-policy --policy-source-arn ROLE_ARN \
  --action-names "iam:CreateUser" "iam:AttachUserPolicy" "sts:AssumeRole"
```

### GCP IAM Audit

```bash
# List all IAM bindings for a project
gcloud projects get-iam-policy PROJECT_ID --format=json

# Find over-permissioned service accounts
gcloud iam service-accounts list --format=json
gcloud projects get-iam-policy PROJECT_ID --format=json | \
  jq '.bindings[] | select(.role | test("owner|admin|editor"))'

# Policy Analyzer
gcloud asset analyze-iam-policy --organization=ORG_ID \
  --identity="serviceAccount:SA@PROJECT.iam.gserviceaccount.com"
```

### Kubernetes RBAC Audit

```bash
# List all cluster role bindings
kubectl get clusterrolebindings -o json | \
  jq '.items[] | {name: .metadata.name, role: .roleRef.name, subjects: .subjects}'

# Check service account permissions
kubectl auth can-i --list --as=system:serviceaccount:NAMESPACE:SA_NAME

# Find cluster-admin bindings
kubectl get clusterrolebindings -o json | \
  jq '.items[] | select(.roleRef.name == "cluster-admin") | .metadata.name'
```

## Workflow

```bash
node scripts/agent.js --provider aws --output /tmp/iam-audit.json
cat /tmp/iam-audit.json | jq '.findings[] | select(.severity == "critical")'
```

## Detection

```yaml
title: Auditing Cloud Identity Permissions Detection
id: 648a6870-bbbc-4886-a665-5d6fd8ca2bac
status: experimental
description: Detects suspicious activity related to auditing cloud identity permissions techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Cloud Identity Permissions Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078.004 |

## Verification

- [ ] No IAM policies with Action: "*" in production
- [ ] All access keys rotated within 90 days
- [ ] Cross-account trust limited to known accounts
- [ ] IAM Access Analyzer shows no public/cross-account findings
- [ ] K8s cluster-admin limited to break-glass accounts
- [ ] Service accounts follow least-privilege

## References

- [AWS IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
- [GCP IAM Overview](https://cloud.google.com/iam/docs/overview)
- [CIS AWS Foundations 1.x — IAM Controls](https://www.cisecurity.org/benchmark/amazon_web_services)
