Cross-Account Role Trust for Privilege Escalation (STS-002)
aws-sts-privesc-cross-account-trust
Attack path
Schematic attack path derived from the query definition. See the full write-up via the attribution link below.
Required IAM permissions
Summary
Roles that trust an external account's root principal can be assumed by any principal in that account, enabling confused-deputy escalation.
Description
Detect IAM roles whose trust policy allows an external AWS account root principal (arn:aws:iam::<account-id>:root) to assume them. Any principal in the trusted external account that holds sts:AssumeRole can assume the role and gain its permissions, which is the confused-deputy escalation surface. The ingested graph does not record trust-policy conditions, so roles protected by an sts:ExternalId condition cannot be filtered out automatically and are surfaced here for manual review.
openCypher query
// Find roles that trust an external account's root principal (cross-account trust)
MATCH path_target = (aws:AWSAccount {id: $provider_uid})--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(trusted:AWSRootPrincipal)
WHERE trusted.arn CONTAINS ':root'
AND NOT trusted.arn CONTAINS aws.id
WITH DISTINCT path_target
WITH collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:ProwlerFinding {status: 'FAIL'})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfrFull attack path write-up
pathfinding.cloud - STS-002 - sts:AssumeRole