Synthèse
At launch, the AWS collector models the AWS services where privilege escalation and lateral movement are used most frequently on our own AWS engagements: IAM – Users, groups, roles, policies, and federated identity providers. AWS Organizations – The full account hierarchy, service control policies and resource control policies that govern permissions across the organization STS – Role assumption and federation including ‘AssumeRole’, SAML, and web identity federation S3 – Buckets, bucke
At launch, the AWS collector models the AWS services where privilege escalation and lateral movement are used most frequently on our own AWS engagements: IAM – Users, groups, roles, policies, and federated identity providers. AWS Organizations – The full account hierarchy, service control policies and resource control policies that govern permissions across the organization STS – Role assumption and federation including ‘AssumeRole’, SAML, and web identity federation S3 – Buckets, bucket policies, ACLs, and object level access KMS – Keys, key policies, grants, and aliases Lambda – Functions and resource policies EC2 – Instances and instance profiles CloudFormation – Stacks and StackSets EKS – Clusters, node groups, and access entries, including IRSA and Pod Identity role assumption SSM – Parameters and managed instances Together, these span more than 20 AWS resource types and over 150 distinct relationships, from IAM privilege escalation to PassRole abuse to cross-account trust, are all derived from a policy engine that reasons about permissions the way AWS itself does.