AWS - STS Enum
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
AWS Security Token Service (STS) is primarily designed to issue temporary, limited-privilege credentials. These credentials can be requested for AWS Identity and Access Management (IAM) users or for authenticated users (federated users).
Given that STS's purpose is to issue credentials for identity impersonation, the service is immensely valuable for escalating privileges and maintaining persistence, even though it might not have a wide array of options.
The action AssumeRole provided by AWS STS is crucial as it permits a principal to acquire credentials for another principal, essentially impersonating them. Upon invocation, it responds with an access key ID, a secret key, and a session token corresponding to the specified ARN.
For Penetration Testers or Red Team members, this technique is instrumental for privilege escalation (as elaborated here). However, it's worth noting that this technique is quite conspicuous and may not catch an attacker off guard.
In order to assume a role in the same account if the role to assume is allowing specifically a role ARN like in:
The role priv-role in this case, doesn't need to be specifically allowed to assume that role (with that allowance is enough).
However, if a role is allowing an account to assume it, like in:
The role trying to assume it will need a specific sts:AssumeRole permission over that role to assume it.
If you try to assume a role from a different account, the assumed role must allow it (indicating the role ARN or the external account), and the role trying to assume the other one MUST to have permissions to assume it (in this case this isn't optional even if the assumed role is specifying an ARN).
In the following page you can check how to abuse STS permissions to escalate privileges:
AWS - STS PrivescLearn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
