Help me understand what the risk in the AWS Privilege Escalation Vulnerabilities article is.
I think it is normal that I create an EC2 instance and associate an IAM role as its instance profile, and then log in to the instance. Once I log in to the instance, I can invoke or access the AWS services that the IRM role allows.
Does it mean the IAM role as the EC2 profile has more IAM permissions than the user role I have as the AWS User and I can get more permissions that I should have via the associated AWS keys it refers to? Then what are the associated AWS keys? Are they the AWS Secret Keys to be created in the IAM console and to be downloaded as a CSV?
- Creating an EC2 instance with an existing instance profile
An attacker with the iam:PassRole and ec2:RunInstances permissions can create a new EC2 instance that they will have operating system access to and pass an existing EC2 instance profile/service role to it. They can then login to the instance and request the associated AWS keys from the EC2 instance meta data, which gives them access to all the permissions that the associated instance profile/service role has.