Enumerate what a stolen AWS key can actually do
Before escalating, map the identity's real permissions with low-noise calls to avoid dead ends and access-denied storms.
Tag: aws
Pivot with AWS SSM instead of SSH
With ssm:StartSession or SendCommand you get shells on instances without keys, ports, or touching the network.
Find and take over dangling S3 references
Deleted buckets still referenced by a CNAME or app config can be re-created by anyone, yielding content control.
Steal cloud credentials through SSRF and IMDS
A server-side fetch on an EC2 instance reaches the metadata service and its role credentials.
AWS privilege escalation via iam:PassRole and Lambda
If you can pass a more privileged role and create or invoke a function, you inherit that role's credentials.