Unauthenticated AWS IAM Principals Enumeration

This beginner-friendly lab teaches several unauthenticated, cross-account techniques for enumerating IAM principals (users and roles) in other AWS accounts. It exploits the fact that AWS returns different responses depending on whether a referenced principal exists, allowing you to confirm valid names and then pivot into the target account.

You are contracted to probe the AWS defenses of Huge Logistics, starting with only their account ID and a single known role named batch. Your mission is to perform comprehensive IAM enumeration, assume a privileged role, and reach the flag stored in a target S3 bucket.

• Basic Linux command line knowledge
• An AWS account for running the enumeration
• AWS CLI configured with the provided keys

• Enumerate cross-account IAM principals using IAM role trust policies
• Enumerate cross-account IAM principals using S3 bucket policies
• Enumerate cross-account IAM principals using Lambda resource policies
• Enumerate IAM users through the AWS console root user login screen
• Automate principal brute forcing with Pacu iam__enum_users and iam__enum_roles modules
• Assume a discovered IAM role and obtain temporary credentials with the AWS CLI
• Understand the CloudTrail events generated and the operational security implications

Mapping IAM users and roles is a key part of understanding an AWS account's attack surface and can expose the services, defenses, and misconfigurations in use. These unauthenticated techniques let attackers profile a target and identify assumable roles without any valid credentials for that account.