---
name: rt-scenario-c001
description: "C-001: Cloud IAM privilege-escalation path assessment. Domain: cloud. Authorized scenario for identifying overpermissive identities, escalation-capable permissions, detection opportunities, and least-privilege remediation."
---

# C-001: Cloud IAM Escalation Path

## Overview

Cloud IAM escalation often results from combinations of permissions that look harmless alone but create administrative impact together. This scenario identifies those paths without modifying production privileges unless explicitly approved.

| Field | Value |
|---|---|
| Domain | Cloud |
| Objective | Find privilege-escalation paths |
| Required Access | Read-only IAM/security review role preferred |
| Detection Risk | Low for read-only review |
| Primary Impact | Cloud account/subscription/project compromise |

## Prerequisites

- Cloud accounts/subscriptions/projects in scope.
- Approved role and API access.
- Permission boundaries for validation.
- Change freeze rules understood.
- Break-glass contact available.

## Risk Patterns

| Pattern | Example Control Gap |
|---|---|
| Policy Attachment | Identity can grant itself broader permissions. |
| Role Passing | Identity can pass privileged roles to compute. |
| Function/Automation Update | Identity can modify code running as privileged role. |
| Key Creation | Identity can create credentials for privileged principals. |
| Trust Policy Weakness | External or unintended principals can assume roles. |

## Workflow

1. Inventory identities, groups, roles, service principals, and workload identities.
2. Identify high-value permissions and admin-equivalent roles.
3. Build escalation path candidates.
4. Validate with policy simulation or read-only evidence.
5. Document affected identity, target role, required permissions, and impact.
6. Recommend the earliest permission removal that breaks the path.

## MITRE ATT&CK Mapping

| Phase | Tactic | Technique |
|---|---|---|
| Access | Initial Access | Valid Cloud Accounts |
| Escalation | Privilege Escalation | Abuse Elevation Control Mechanism |
| Defense | Defense Evasion | Modify Cloud Compute Infrastructure |

## Evidence

- Identity ARN/object ID.
- Relevant policy statements.
- Trust relationship.
- Simulation output.
- Business owner if known.

## Remediation

- Apply least privilege.
- Use permission boundaries.
- Restrict role passing.
- Separate deployment and runtime roles.
- Monitor IAM policy changes.
- Require approval for privileged role changes.

