Explanation of the AWS IAM PassRole vulnerability

Question

Help me understand what the risk in the AWS Privilege Escalation Vulnerabilities article is.

I think it is normal that I create an EC2 instance and associate an IAM role as its instance profile, and then log in to the instance. Once I log in to the instance, I can invoke or access the AWS services that the IRM role allows.

Does it mean the IAM role as the EC2 profile has more IAM permissions than the user role I have as the AWS User and I can get more permissions that I should have via the associated AWS keys it refers to? Then what are the associated AWS keys? Are they the AWS Secret Keys to be created in the IAM console and to be downloaded as a CSV?

3. Creating an EC2 instance with an existing instance profile

An attacker with the iam:PassRole and ec2:RunInstances permissions can create a new EC2 instance that they will have operating system access to and pass an existing EC2 instance profile/service role to it. They can then login to the instance and request the associated AWS keys from the EC2 instance meta data, which gives them access to all the permissions that the associated instance profile/service role has.

Answer 1

This vulnerability is a privilege escalation and can be broken down as follows:

1. Start an ec2 instance with an associated role that gives you more privileges than your IAM user.
2. Log in to the ec2 instance, either via access keys assigned to the instance or by creating a reverse shell via user-data
3. Access the Instance Identity role found in the instance's metadata, and use the AWS CLI to escalate your privileges by using permissions from the associated role.

Does it mean the IAM role as the EC2 profile has more IAM permissions than the user role I have as the AWS User

This depends on the IAM role that gets associated with the ec2 instance. The point of this vulnerability is that you can assign a role to an ec2 instance at launch time.

Then what are the associated AWS keys

I believe what they are referring to is a temporary access key pair and session token.

The credentials consist of an AWS temporary access key pair and a session token. They are used to sign AWS Sigv4 requests to the AWS services that use the instance identity role. The credentials are present in the instance metadata regardless of whether a service or feature that makes use of instance identity roles is enabled on the instance.

References
Instance Identity roles