AWS Pentesting Cheat Sheet (IAM)

Reference

• AWS-CLI-IAM

Configure AWS Access & Secret Key

# Create profile.
aws configure --profile [name]

# Check whoami.
aws sts get-caller-identity --profile [name]

List IAM Uses

aws iam get-user --profile [name]
aws iam list-users --profile [name]
aws iam list-access-keys --profile [name]

Get User Permissions

List attached managed policies

aws iam list-attached-user-policies --user-name [user-name]

List inline policies

aws iam list-user-policies --user-name [user-name]

Get inline policy details

aws iam get-user-policy --user-name [user-name] --policy-name [policy-name]

List IAM Groups and Permissions

List groups

aws iam list-gtoups --profile [name]

List groups for a user

aws iam list-groups-for-user --user-name [user-name]

List group policies

aws iam list-attached-group-policies --group-name [group-name]
aws iam list-group-policies --group-name [group-name]

Get inline group policy details

aws iam get-group-policy --group-name [group-name] --policy-name [policy-name]

List IAM Roles and Permissions

List all roles

aws iam list-roles

Get role details (trust policy)

aws iam get-role --role-name [role-name]

List attached policies

aws iam list-attached-role-policies --role-name [role-name]

List inline policies

aws iam list-role-policies --role-name [role-name]

Get inline role policy details

aws iam get-role-policy --role-name [role-name] --policy-name [policy-name]

Get and Decode Policy Documents

Get a managed policy document (by ARN or name)

aws iam get-policy --policy-arn [policy-arn]
aws iam get-policy-version --policy-arn [policy-arn] --version-id [version-id]

View Full IAM Snapshot

Dump all IAM permissions (users, roles, groups, policies)

aws iam get-account-authorization-details