- Steal cloud credentials through SSRF and IMDS A server-side fetch on an EC2 instance reaches the metadata service and its role credentials.
- AWS privilege escalation via iam:PassRole and Lambda If you can pass a more privileged role and create or invoke a function, you inherit that role's credentials.
- Enumerate IAM before you escalate In the cloud, privilege escalation is a graph problem. Map what your identity can do first.