Enumerate (Unauthenticated) IAM Users and Roles

Exploiting an AWS feature of the IAM Role Trust Policy allowing for unauthenticated enumeration of AWS IAM Users and Roles in AWS Accounts.

We need to know the AWS Account ID for this technique to work. Refer to Enumerate AWS Account IDs for methods on how to obtain this.

Rhino Security Labs has a great blog post detailing how this works

Unauthenticated Enumeration of IAM Users and Roles

• Essentially, when updating an IAM Role's Trust Policy, AWS will either allow it or return an error

• The error is returned if the ARN of the identity does not exist

Leveraging AWS Console

• First, create an IAM Role and then update its Trust Policy

• Principals can be specified in an IAM Role's policy and will provide an error if the principal is invalid

Trying to add a non-valid IAM User to an IAM Role Trust Policy

---

Leveraging AWS CLI

• Principals can be specified in an IAM Role's policy and will provide an error if the principal is invalid

1. Create IAM Role

Create an IAM Role Policy with a valid principal

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111111111111:user/valid-user"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Create the IAM Role

aws iam create-role --role-name myRole --assume-role-policy-document file://roletrustpolicy.json

2. Update Role Policy

---

Leveraging Pacu

• Pacu provides modules that automatically attempt to enumerate valid IAM Users and Roles in an AWS account using this method

• Pacu will also attempt to assume the role which will provide credentials for the role

• Default wordlists are used unless you specify your own

Users

run iam__enum_users --role-name <MyRoleName> --account-id 111111111111

Roles

Custom Wordlist

---

Leveraging S3

• Principals can be specified in an S3 Bucket's policy and will provide an error if the principal is invalid

1. Create S3 Bucket

aws s3api create-bucket --bucket <bucketName> 

2. Create Bucket Policy

3. Update Bucket Policy

---

Leveraging Lambda

• Principals can be specified in a Lambda Function's resource policy and will provide an error if the principal is invalid

1. Create Lambda Role

Create Trust Policy for IAM Role

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "lambda.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Create IAM Role

aws iam create-role --role-name lambda-role --assume-role-policy-document file://lambdapolicy.json 

2. Create Lambda Function

3. Update Lambda Policy