Check ID: iam_inline_policy_allows_privilege_escalation
Provider: AWS
Service: iam
Severity: HIGH
Categories: identity-access, privilege-escalation
Resource type: AwsIamPolicy

​
What this check verifies

IAM inline policies are evaluated for permission combinations that enable privilege escalation, such as sts:AssumeRole, iam:PassRole, attaching/editing policies, or broad wildcards. The result highlights inline policies that allow a principal to obtain higher effective access.

​
Risk

Excessive inline policy permissions let identities escalate to admin, compromising CIA:
  • Confidentiality: read secrets and data
  • Integrity: alter policies, code, and configs
  • Availability: delete or stop resources, disable logging Attackers can persist by creating keys/users or assuming powerful roles.

​
Recommendation

Apply least privilege and remove escalation paths:
  • Avoid wildcards and sensitive actions like sts:AssumeRole, iam:PassRole, or policy modification without tight scope
  • Restrict by resource and Condition
  • Prefer managed, versioned policies; use permissions boundaries/SCPs
  • Require reviews and MFA for admins

​
Remediation

# Terraform: Replace the risky inline policy with least-privilege actions
resource "aws_iam_user_policy" "<example_resource_name>" {
  name = "<example_resource_name>"
  user = "<example_resource_name>"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "ec2:DescribeInstances"  # FIX: only non-privilege-escalation action; remove IAM/STS escalation actions
      Resource = "*"                       # FIX: safe read-only scope
    }]
  })
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_inline_policy_allows_privilege_escalation. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks