Potential Wildcard Role Trust (STS-003)
aws-sts-privesc-wildcard-trust
Attack path
IAM principal
sts:AssumeRole
sts:AssumeRole
Privileged role
Privilege escalation
Schematic attack path derived from the query definition. See the full write-up via the attribution link below.
Required IAM permissions
sts:AssumeRole
Summary
Potential wildcard role trusts that need manual review before they are treated as assumable.
Description
Find IAM roles linked to a wildcard principal ("AWS": "*"). The ingested graph does not preserve trust-policy Effect or Condition fields, so a match can come from a Deny statement or a restricted Allow statement. Treat each result as a candidate for manual review, not as a confirmed assumable role.
openCypher query
// Find roles linked to a wildcard principal for manual review
MATCH path_target = (aws:AWSAccount {id: $provider_uid})--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(trusted:AWSPrincipal)
WHERE trusted.arn = '*'
WITH DISTINCT path_target
WITH collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:ProwlerFinding {status: 'FAIL'})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfrFull attack path write-up
pathfinding.cloud - STS-003 - sts:AssumeRole