Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
sts:AssumeRoleEvery role is created with a role trust policy, this policy indicates who can assume the created role. If a role from the same account says that an account can assume it, it means that the account will be able to access the role (and potentially privesc).
For example, the following role trust policy indicates that anyone can assume it, therefore any user will be able to privesc to the permissions associated with that role.
You can impersonate a role running:
Potential Impact: Privesc to the role.
Note that in this case the permission sts:AssumeRole needs to be indicated in the role to abuse and not in a policy belonging to the attacker.
With one exception, in order to assume a role from a different account the attacker account also needs to have the sts:AssumeRole over the role.
sts:GetFederationTokenWith this permission it's possible to generate credentials to impersonate any user:
This is how this permission can be given securely without giving access to impersonate other users:
sts:AssumeRoleWithSAMLA trust policy with this role grants users authenticated via SAML access to impersonate the role.
An example of a trust policy with this permission is:
To generate credentials to impersonate the role in general you could use something like:
But providers might have their own tools to make this easier, like onelogin-aws-assume-role:
Potential Impact: Privesc to the role.
sts:AssumeRoleWithWebIdentityThis permission grants permission to obtain a set of temporary security credentials for users who have been authenticated in a mobile, web application, EKS... with a web identity provider. Learn more here.
For example, if an EKS service account should be able to impersonate an IAM role, it will have a token in /var/run/secrets/eks.amazonaws.com/serviceaccount/token and can assume the role and get credentials doing something like:
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
