A USAGE-AWARE METHOD FOR REPAIRING PRIVILEGE ESCALATION PATHS IN AWS IDENTITY AND ACCESS MANAGEMENT
DOI:
https://doi.org/10.28925/2663-4023.2026.35.1452Keywords:
cloud security; AWS IAM; privilege escalation; least privilege; access control repair; MaxSAT; constraint programming; usage logs.Abstract
Misconfigured identity policies in Amazon Web Services (AWS) let a low-privileged user or role obtain administrator rights through chains of individually harmless permissions such as iam:PassRole or iam:CreateAccessKey. Existing repair methods choose the fix by the number of policy changes, so a “minimal” repair can break deployments, service roles and people who use the permission for legitimate work. This paper proposes a usage-aware method for repairing privilege escalation paths in AWS Identity and Access Management (IAM). The account is modeled as a permission graph with monotone escalation rules, and usage evidence from access logs defines operational impact as the weighted number of observed (principal, action, resource) uses that a repair would break. Repair is solved as an exact counterexample-guided CP-SAT optimization that either minimizes impact under full safety or maximizes removed risk under a change budget; under stated monotonicity assumptions the result is optimal within the repair vocabulary. On 50 synthetic organizations the method removed all escalations while breaking 78% fewer legitimate uses than a minimum-size repair (32 versus 144; Wilcoxon test, p < 10⁻⁶), at the cost of a median of 6.5 instead of 3 edited policy statements. Hiding iam:PassRole from the evidence, as AWS last-accessed data does, raised impact from 1.21 to 2.18, and a conservative prior for unobservable actions brought it back to 1.21. With four changes the budgeted variant removed 96.7% of escalation risk. On a public export of the IAM Vulnerable account the model detected 50 of 58 in-scope escalation scenarios, and usage-aware repair reduced impact by 65.7% relative to a minimum-size repair.
Downloads
References
Novaes Neto, N., Madnick, S. E., Moraes G. de Paula, A., & Malara Borges, N. (2020). A case study of the Capital One data breach [Working paper]. SSRN. https://doi.org/10.2139/ssrn.3542567
Hu, Y., Wang, W., Khurshid, S., McMillan, K. L., & Tiwari, M. (2023). Fixing privilege escalations in cloud access control with MaxSAT and graph neural networks. In Proceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) (pp. 104–115). IEEE. https://doi.org/10.1109/ASE56229.2023.00167
Gietzen, S. (2018). AWS IAM privilege escalation: Methods and mitigation. Rhino Security Labs. https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
Datadog Security Labs. (n.d.). pathfinding.cloud: AWS IAM privilege escalation library. https://pathfinding.cloud/
NCC Group. (n.d.). Principal Mapper (PMapper) [Computer software]. GitHub. https://github.com/nccgroup/PMapper
Shevrin, I., & Margalit, O. (2023). Detecting multi-step IAM attacks in AWS environments via model checking. In 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association. https://www.usenix.org/conference/usenixsecurity23/presentation/shevrin
Hu, Y., Wang, W., Khurshid, S., & Tiwari, M. (2023). TAC: Hybrid IAM privilege escalation detection (arXiv:2304.14540, version 9, 2026) [Preprint]. arXiv. https://arxiv.org/abs/2304.14540
Chen, J. (2022, July 25). IAM-Deescalate: An open source tool to help users reduce the risk of privilege escalation. Palo Alto Networks Unit 42. https://unit42.paloaltonetworks.com/iam-deescalate/
Amazon Web Services. (n.d.). Refine permissions in AWS using last accessed information. AWS Identity and Access Management User Guide. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html
Art, S. (2021, September 9). IAM Vulnerable: An AWS IAM privilege escalation playground. Bishop Fox. https://bishopfox.com/blog/aws-iam-privilege-escalation-playground
Liu, X., Yang, N., Li, C., Li, J., Ma, J., & Lu, K. (2026). The dark side of flexibility: Detecting risky permission chaining attacks in serverless applications. In Proceedings of the Network and Distributed System Security Symposium (NDSS). Internet Society. https://doi.org/10.14722/ndss.2026.230819
Rudin, D., Vasylenko, V., & Grynkevych, G. (2025). AI agents for automated network incident detection and misconfiguration identification. International Scientific Journal “Internauka”, (12). https://doi.org/10.25313/2520-2057-2025-12
Backes, J., Bolignano, P., Cook, B., Dodge, C., Gacek, A., Luckow, K., Rungta, N., Tkachuk, O., & Varming, C. (2018). Semantic-based automated reasoning for AWS access policies using SMT. In 2018 Formal Methods in Computer Aided Design (FMCAD) (pp. 1–9). IEEE. https://doi.org/10.23919/FMCAD.2018.8602994
Bouchet, M., Cook, B., Cutler, B., Druzkina, A., Gacek, A., Hadarean, L., Jhala, R., Marshall, B., Peebles, D., Rungta, N., Schlesinger, C., Stephens, C., Varming, C., & Warfield, A. (2020). Block public access: Trust safety verification of access control policies. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (pp. 281–291). ACM. https://doi.org/10.1145/3368089.3409728
D’Antoni, L., Ding, S., Goel, A., Ramesh, M., Rungta, N., & Sung, C. (2024). Automatically reducing privilege for access control policies. Proceedings of the ACM on Programming Languages, 8(OOPSLA2), 763–790. https://doi.org/10.1145/3689738
Eiers, W., Sankaran, G., & Bultan, T. (2023). Quantitative policy repair for access control on the cloud. In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) (pp. 564–575). ACM. https://doi.org/10.1145/3597926.3598078
Wu, K. L., Jenkins, C., Stoller, S. D., & Chowdhury, O. (2026). Automatically tightening access control policies with Restricter. In Tools and Algorithms for the Construction and Analysis of Systems (TACAS 2026) (Lecture Notes in Computer Science, pp. 110–129). Springer. https://doi.org/10.1007/978-3-032-22752-2_6
Hall, B., Ungaro, O., & Eiers, W. (2025). CloudFix: Automated policy repair for cloud access control policies using large language models (arXiv:2512.09957) [Preprint]. arXiv. https://arxiv.org/abs/2512.09957
Sanders, M. W., & Yue, C. (2017). Automated least privileges in cloud-based web services. In Proceedings of the Fifth ACM/IEEE Workshop on Hot Topics in Web Systems and Technologies (HotWeb) (pp. 1–6). ACM. https://doi.org/10.1145/3132465.3132470
Sanders, M. W., & Yue, C. (2018). Minimizing privilege assignment errors in cloud services. In Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy (CODASPY) (pp. 2–12). ACM. https://doi.org/10.1145/3176258.3176307
Vaidya, J., Atluri, V., Guo, Q., & Adam, N. (2008). Migrating to optimal RBAC with minimal perturbation. In Proceedings of the 13th ACM Symposium on Access Control Models and Technologies (SACMAT) (pp. 11–20). ACM. https://doi.org/10.1145/1377836.1377839
Sheyner, O., Haines, J., Jha, S., Lippmann, R., & Wing, J. M. (2002). Automated generation and analysis of attack graphs. In Proceedings 2002 IEEE Symposium on Security and Privacy (pp. 273–284). IEEE. https://doi.org/10.1109/SECPRI.2002.1004377
Noel, S., Jajodia, S., O’Berry, B., & Jacobs, M. (2003). Efficient minimum-cost network hardening via exploit dependency graphs. In 19th Annual Computer Security Applications Conference (ACSAC 2003) (pp. 86–95). IEEE. https://doi.org/10.1109/CSAC.2003.1254313
Wang, L., Noel, S., & Jajodia, S. (2006). Minimum-cost network hardening using attack graphs. Computer Communications, 29(18), 3812–3824. https://doi.org/10.1016/j.comcom.2006.06.018
Guo, M., Li, J., Neumann, A., Neumann, F., & Nguyen, H. (2022). Practical fixed-parameter algorithms for defending Active Directory style attack graphs. Proceedings of the AAAI Conference on Artificial Intelligence, 36(9), 9360–9367. https://doi.org/10.1609/aaai.v36i9.21167
Abdulraheem, W. K., Ibbini, E. M., Kanaker, H., Smadi, S., Abdel Karim, N., Fakhouri, H. N., Albdour, L., & Fakhouri, S. (2026). Least-privilege role-based access control improvement for cloud container security. Computers, 15(5), 326. https://doi.org/10.3390/computers15050326
Kobilnyk, B., & Sydorenko, V. (2026). Experimental study of an adaptive contextual access control model for increasing the resilience of critical information systems [in Ukrainian]. Cybersecurity: Education, Science, Technique, 2(34), 702–718. https://doi.org/10.28925/2663-4023.2026.34.1364
Syrotynskyi, R., & Tyshyk, I. (2026). Improving compliance with zero trust principles in enterprise network architecture using artificial intelligence [in Ukrainian]. Cybersecurity: Education, Science, Technique, 2(34), 630–645. https://doi.org/10.28925/2663-4023.2026.34.1356
Grynkevych, G., Vasylenko, V., & Rudin, D. (2026). Local open-source platform for cyber incident monitoring and response with AI support as an alternative to EDR/XDR solutions. Cybersecurity: Education, Science, Technique, 1(33), 234–241. https://doi.org/10.28925/2663-4023.2026.33.1211
Pliekhov, O., Grynkevych, G., & Vasylenko, V. (2026). An extended STRIDE threat model for offline BLE mesh disaster communication applications. Cybersecurity: Education, Science, Technique, 2(34), 726–743. https://doi.org/10.28925/2663-4023.2026.34.1368
Jenkyn, J., & Wadman, L. (2022, November 3). How to use trust policies with IAM roles. AWS Security Blog. https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/
Perron, L., & Furnon, V. (n.d.). OR-Tools (Version 9.15) [Computer software]. Google. https://developers.google.com/optimization
Ignatiev, A., Morgado, A., & Marques-Silva, J. (2018). PySAT: A Python toolkit for prototyping with SAT oracles. In Theory and Applications of Satisfiability Testing (SAT 2018) (Lecture Notes in Computer Science, Vol. 10929, pp. 428–437). Springer. https://doi.org/10.1007/978-3-319-94144-8_26
Salesforce. (n.d.). Cloudsplaining: AWS IAM security assessment tool [Computer software]. GitHub. https://github.com/salesforce/cloudsplaining
Rudin, D., Vasylenko, V., & Grynkevych, G. (2026). Adaptive network security automation: DevSecOps, ML detection, and policy-as-code. International Scientific Journal “Internauka”, (1). https://doi.org/10.25313/2520-2057-2026-1
Grynkevych, G., Vasylenko, V., Rudin, D., & Pliekhov, O. (2026). Design and implementation of automated firewall policy management in enterprise telecommunication systems using infrastructure-as-code. Zviazok, (4), 3–12. https://doi.org/10.31673/2412-9070.2026.049412
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Ганна Гринкевич, Володимир Василенко
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
