Assume Privileged Role with External ID

This beginner-friendly lab demonstrates how an exposed configuration file and the use of a production account to test policies can be chained to assume a privileged role protected by an External ID. Starting from a single IP address, you fuzz for an exposed config.json containing AWS keys, enumerate permissions, extract credentials from Secrets Manager, and inspect IAM policies and role trust relationships. You then assume a cost-optimization partner role using its required External ID to retrieve protected payment card data.

Huge Logistics engaged your firm for a security evaluation of their on-premises and cloud setups, and early reconnaissance surfaced the IP address 52.0.51.234. Your mission is to use this IP as an entry point, move laterally through their environment, and determine potential areas of impact.

• Basic Linux command line knowledge
• AWS CLI installed and configured
• Familiarity with web fuzzing tools such as ffuf

• Fuzz a web server for exposed files with ffuf to discover an exposed config.json
• Enumerate AWS permissions automatically using aws-enumerator
• List and retrieve secrets from AWS Secrets Manager
• Enumerate IAM users, roles, and policy documents with the AWS CLI
• Obtain AWS CLI credentials from an AWS Console CloudShell session
• Assume a privileged role that requires an sts:ExternalId condition
• Retrieve protected payment data using the assumed role privileges

Exposed configuration files that leak cloud credentials are a recurring real-world issue, as seen in public reports such as a 2022 HackerOne disclosure to the U.S. Department of Defense. The External ID condition on AssumeRole functions like a password for cross-account access, and mishandling it can allow untrusted callers to assume privileged roles.