Security Engineering & Cloud Security Agents
Problem Statement
Analyzing AWS/GCP IAM permission structures to determine potential escalation pathways (e.g., iam:PassRole combined with ec2:RunInstances) requires evaluating complex, nested JSON policy documents. Human reviewers easily miss transitive permission grants, leading to undetected attack paths.
Goal
Build an agentic security scanner that ingests IAM policy JSON, identifies high-risk privilege escalation vectors, and calculates the potential blast radius.
Outcome Measurement
- Escalation Vector Discovery: Identified 100% of known AWS IAM privilege escalation patterns in test suites.
- Remediation Speed: Generated least-privilege replacement policies automatically.
How the Code was Built
The implementation extracts statement blocks from IAM policy JSON, runs structured LLM evaluation against known privilege escalation patterns, and outputs an assessment.
Executable Code
import jsonfrom pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass EscalationVector(BaseModel): technique_name: str = Field(description="Name of privilege escalation technique, e.g., iam:PassRole to EC2") vulnerable_action: str = Field(description="Action permitting escalation") blast_radius: str = Field(description="HIGH, MEDIUM, or LOW impact assessment") remediation_policy: str = Field(description="Least-privilege policy replacement JSON")def analyze_iam_policy(iam_policy_json: dict) -> EscalationVector: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(EscalationVector) prompt = f"""Analyze this AWS IAM Policy for privilege escalation vulnerabilities:{json.dumps(iam_policy_json, indent=2)}Evaluate if actions like iam:PassRole, iam:CreateAccessKey, iam:AttachUserPolicy allow escalation to Administrator Access.""" return structured_llm.invoke(prompt)if __name__ == "__main__": vulnerable_iam = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:PassRole", "ec2:RunInstances" ], "Resource": "*" } ] } res = analyze_iam_policy(vulnerable_iam) print(f"Technique Identified: {res.technique_name}") print(f"Blast Radius: {res.blast_radius}") print(f"Remediation Policy:\n{res.remediation_policy}")
Leave a Reply