Listen to this Post
Source: Root in prod: The most important security analysis you will never do on your AWS accounts
You Should Know:
1. Mapping AWS Trust Relationships
AWS IAM roles often trust other roles, creating a complex web of permissions. To audit these relationships, use the following AWS CLI commands:
aws iam list-roles --query 'Roles[].Arn' --output text aws iam list-trust-relationships --role-name <ROLE_NAME>
For a full transitive trust analysis, use AWS IAM Policy Simulator or AWS Access Analyzer:
aws accessanalyzer analyze-policy --policy-document file://policy.json
2. Detecting Over-Permissive Roles
Check roles with admin privileges:
aws iam list-roles --query 'Roles[?AssumeRolePolicyDocument.Statement[].Principal.AWS==``].Arn'
3. Github-to-AWS Privilege Escalation Check
If your AWS roles trust GitHub OIDC, verify who can assume them:
aws iam get-role --role-name <GITHUB_ASSUMABLE_ROLE> --query 'Role.AssumeRolePolicyDocument'
4. Automated Trust Mapping with Python
Use this script to list all trust relationships in an AWS account:
import boto3
iam = boto3.client('iam')
roles = iam.list_roles()['Roles']
for role in roles:
trust_policy = role['AssumeRolePolicyDocument']
print(f"Role: {role['RoleName']}")
print(f"Trusts: {trust_policy['Statement'][bash]['Principal']}")
5. Preventing Transitive Trust Exploits
Enforce SCP (Service Control Policies) in AWS Organizations:
aws organizations create-policy --name "DenyTransitiveTrusts" --description "Block risky cross-account trusts" --content file://scp.json
6. AWS Security Best Practices
- Enable AWS GuardDuty for anomaly detection.
- Use AWS IAM Access Analyzer for policy validation.
- Restrict STS AssumeRole to specific IP ranges.
What Undercode Say:
AWS trust relationships are a silent security risk. Many organizations unknowingly grant excessive permissions through nested role assumptions. The key takeaways:
– Audit IAM roles regularly with aws iam list-roles.
– Enforce least privilege using SCPs and boundary policies.
– Monitor OIDC integrations (like GitHub) for unintended access.
– Automate trust mapping to detect hidden privilege escalation paths.
Expected Output:
Role: Prod-Admin
Trusts: {"AWS": "arn:aws:iam::123456789012:role/DevOps-Role"}
Role: DevOps-Role
Trusts: {"Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"}
Prediction:
As cloud environments grow, transitive trust risks will increase, leading to more supply-chain attacks. Companies must adopt automated IAM auditing to prevent breaches.
Relevant URLs:
References:
Reported By: Danielgrzelak Root – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
