Skip to main content

CIEM & attack paths

A misconfiguration is a fact; an attack path is a story - the chain that turns "this bucket is public" into "an attacker takes over the account." Cloud Posture computes both.

CIEM - identity & privilege escalation​

apPosture analyses IAM for privilege-escalation paths using the well-known privesc set: editing a policy version, attaching an admin policy, creating credentials, sts:AssumeRole, broad iam:PassRole, and Lambda code injection.

To keep the signal clean, these are flagged only in unconditional Allow statements - a grant constrained by a Condition is treated as legitimate - and the wide-blast-radius ones (broad PassRole, Lambda injection) require a wildcard resource. Representative controls:

  • IAM privilege escalation (critical, CWE-269) - a policy that enables one of the privesc primitives.
  • Role reaches admin - a role with a privesc path to account-admin, tagged MITRE T1548.
  • Confused-deputy trust - external-account trust without an ExternalId / SourceArn.
  • Wildcard trust - a role that trusts Principal: *.

Admin roles are recognised cross-cloud - GCP owner / editor / iam.securityAdmin / serviceAccountTokenCreator, Azure Owner / Contributor / User Access Administrator.

Attack paths​

The Attack paths tab renders toxic combinations that actually exist in the snapshot. A path is only drawn when every edge is present - a missing link means no path, never a fabricated one. Modeled chains include:

  • internet → security group → instance → assumes IAM role → escalates → account admin (critical). IMDSv1 is annotated on the instance→role edge - SSRF can steal the role's credentials.
  • internet → public S3 bucket and internet → public RDS.

Alongside the graph, the evaluator flags crown-jewel toxic combinations: a resource that carries an internet-exposure finding plus a privilege, data or threat dimension is escalated to critical - exposure is the required ignition.

Notable attack-path controls​

  • IMDSv2 not enforced, and an IMDS hop limit > 1 that lets a container reach the instance's credentials.
  • IRSA absent on EKS - pods fall back to the node role.
  • ELB HTTP desync mitigation not set to strictest.
  • CloudFront origin reachable directly (bypassing the distribution and its WAF), HTTP allowed, or deprecated TLS.
  • Subdomain takeover via Route 53 - an A/AAAA record pointing at a released Elastic IP the account no longer owns (reported N/A if the IP list cannot be read).
  • Lambda / Elastic Beanstalk execution role has admin, and Lambda function URLs with AuthType=NONE.
  • Proven internet reachability (EC2.REACH) - requiring an internet gateway, a public IP, an open security group and aligned NACLs together, so "reachable" is not guessed.

Attack-path collection runs live in a bounded background thread (about 8 seconds); if it cannot finish it falls back to a clearly-labelled example graph rather than blocking.