Can I escalate my privileges if I have read-write access to IAM service in AWS?

Question

We are trying to convince folks in our company to grant developers full privileges to all services in "dev" account (current policy does not allow developers to create anything in our AWS account, because "security").

Folks say we might grant you full privileges to certain services e.g. S3, but some services (specifically IAM) will be off limits. Argument is users would be able to grant themselves all kind of permissions if they have read/write access to IAM service in our account.

In following scenario:

• There are two S3 buckets (s1 and s2) in an AWS account.
• User kashyap is granted full control over s1, but not s2 (se he can't see/read/write/access/manage s2 at all).
• User kashyap is granted full control over IAM service.

Questions:

1. Can kashyap grant himself access to s2 by doing something in IAM?
2. Can kashyap create a new IAM user that has access to s2?
3. If answer to either 1 or 2 is yes, then is there a way to prevent it other than revoking all IAM privileges of kashyap? Someone suggested Cloud Custodian

Note that S3 is just an example and I know one could work around this using S3 policy. My question is more broad and could be applied to any resource like EC2 instance, Lambda function or Dynamo DB table/instance.

---

I've read:

• https://stackoverflow.com/questions/71230412/limiting-other-aws-iam-roles-from-interacting-with-resources-privilege-escalatio
• https://stackoverflow.com/questions/70580724/how-to-avoid-privilege-escalation-in-aws

and a few more..

Answer 1

Yes, normally if you have full read/write access to IAM, you can give yourself access to anything. Even if you give users full IAM policy control, you can use AWS permissions boundaries to set up limits to the permissions that another user can grant themselves. In this case they can only do what their permissions and their permission boundaries both allow them to do.

The configuration of all of this is complex and likely to get in the way of development. The simplest way to handle this is for each developer to have their own separate account where they can do whatever they want and are, in some way, responsible for their own costs. If you are paying for developer accounts then make it clear that the accounts might be cleared out or deleted at any time, especially if there is a concern about costs, so nothing permanent or from production may be put there.

Regarding the questions

Q1. Can kashyap grant himself access to s2 by doing something in IAM?

A1. Yes, if kashyap has write access to IAM then he can grant himself access. If a permission boundary doesn't allow him to grant permissions on s2 then no.

Q2. Can kashyap create a new IAM user that has access to s2?

A2. Yes, if kashyap has write access to IAM then he can create a user.

Q3. If answer to either 1 or 2 is yes, then is there a way to prevent it other than revoking all IAM privileges of kashyap? Someone suggested Cloud Custodian

A3. The section "Delegating responsibility to others using permissions boundaries" in the AWS manual for Permissions boundaries for IAM entities describes almost exactly this situation. By setting boundaries on both kashyap and any new users created, the administrator can ensure that kashyap does not give permissions to access the bucket s2

Cloud Custodian's IAM rules appear to lack the full granularity needed to do what is needed here.