AWS IAM Enumeration

Configure AWS cli

aws configure

OR configure it using a profile

aws configrue --profile EXAMPLE_NAME

The credential file is located in

~/.aws/credentials

Commands:

1) Listing IAM access keys

aws iam list-access-keys 

Enumerating IAM users

1) Checking credentials for the user

aws sts get-caller-identity 

2) Listing IAM users

aws iam list-users 

3) Enumerate users and roles via S3 Bucket Policy

aws s3api put-bucket-policy --bucket iam-enum --policy file://s3_policy.json 

4) Listing the IAM groups that the specified IAM user belongs to

aws iam list-groups-for-user --user-name USER_NAME 

5) Listing all manages policies that are attached to the specified IAM user

aws iam list-attached-user-policies --user-name USER_NAME 

6) Listing the names of the inline policies embedded in the specified IAM user

aws iam list-user-policies --user-name USER_NAME 

Enumerating IAM groups

1) Listing IAM groups

aws iam list-groups 

2) Listing all managed policies that are attached to the specified IAM Group

aws iam list-attached-group-policies --group-name GROUP_NAME 

3) Listing the names of the inline policies embedded in the specified IAM Group

aws iam list-group-policies --group-name GROUP_NAME 

Enumerating IAM Roles

1) Listing IAM roles

aws iam list-roles 

2) Listing all managed policies that are attached to the specified IAM role

aws iam list-attached-role-policies --role-name ROLE_NAME 

3) Listing the names of the inline policies embedded in the specified IAM role

aws iam list-role-policies --role-name ROLE_NAME 

Enumerating IAM Policies

1) Listing of IAM policies

aws iam list-policies 

2) Retrieving information about the specified managed policy

aws iam get-policy --policy-arn POLICY_ARN 

3) Listing information about the versions of the specified manages policy

aws iam list-policy-versions --policy-arn POLICY_ARN 

4) Retrieving information about the specific version of the specified managed policy

aws iam get-policy-version --policy-arn POLICY_ARN --version-id VERSION_ID

Retrieving the specified inline policy document that is embedded on the specified IAM user / group / role

aws iam get-user-policy --user-name USER_NAME --policy-name POLICY_NAME

aws iam get-group-policy --group-name GROUP_NAME --policy-name POLICY_NAME

aws iam get-role-policy --role-name ROLE_NAME --policy-name POLICY_NAME