Enumerate what a stolen AWS key can actually do
Before escalating, map the identity's real permissions with low-noise calls to avoid dead ends and access-denied storms.
Tag: iam
GCP privilege escalation with serviceAccounts.getAccessToken
iam.serviceAccounts.getAccessToken over a more privileged service account lets you mint its token and inherit its access.
AWS privilege escalation via iam:PassRole and Lambda
If you can pass a more privileged role and create or invoke a function, you inherit that role's credentials.