brief

# Lab: `iam_privesc_policy_version`

b2b_saas / medium / `enterprise-payroll` · prod

## Your job

An internal developer identity has been provisioned with limited scope. Can it reach a role that administers the account, and how?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n16_a524/acct-main`: **Account** prod-account-a524
- `n42_a524/role-developer`: **IAMRole** DeveloperOperationsRole-a524
- `n39_a524/pol-dev-tools`: **IAMPolicy** PolicyLifecycleManagementPolicy-a524
- `n43_a524/role-app-operator`: **IAMRole** AppOperatorRole-a524
- `n30_a524/pol-target-app`: **IAMPolicy** AppOperatorDataPolicy-a524
- `n04_a524/s3-payroll-records`: **S3Bucket** payroll-records-prod-000000000000-a524
- `n37_a524/data-payroll-records`: **DataSet** payroll-financial-records-a524
- `n01_a524/role-report-builder`: **IAMRole** ReportBuilderRole-a524
- `n19_a524/role-config-sync`: **IAMRole** ConfigSyncRole-a524
- `n45_a524/role-release-orchestrator`: **IAMRole** ReleaseOrchestratorRole-a524
- `n02_a524/role-cost-explorer`: **IAMRole** CostExplorerRole-a524
- `n33_a524/pol-cost-explorer-read`: **IAMPolicy** CostExplorerReadPolicy-a524
- `n08_a524/role-partner-sync`: **IAMRole** PartnerSyncRole-a524
- `n44_a524/pol-partner-sync-read`: **IAMPolicy** PartnerSyncReadPolicy-a524
- `n09_a524/s3-public-docs`: **S3Bucket** public-docs-mirror-a524
- `n31_a524/s3-public-docs`: **S3Bucket** public-docs-mirror-2-a524
- `n34_a524/s3-partner-uploads`: **S3Bucket** partner-uploads-a524
- `n21_a524/trail-partner-uploads`: **LogTrail** trail-partner-uploads-a524
- `n41_a524/data-partner-uploads`: **DataSet** partner-upload-files-a524
- `n40_a524/s3-app-config`: **S3Bucket** app-config-store-a524
- `n25_a524/trail-app-config`: **LogTrail** trail-app-config-a524
- `n38_a524/data-app-config`: **DataSet** app-config-values-a524
- `n32_a524/s3-billing-exports`: **S3Bucket** billing-exports-archive-a524
- `n07_a524/trail-billing-exports`: **LogTrail** trail-billing-exports-a524
- `n27_a524/data-billing-exports`: **DataSet** billing-statements-a524
- `n24_a524/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-a524
- `n03_a524/ecr-utility-image`: **EcrRepository** repo-utility-image-a524
- `n14_a524/kms-storage-general`: **KmsKey** kms-storage-general-a524
- `n18_a524/role-datadog-monitoring`: **IAMRole** DatadogMonitoringRole-a524
- `n17_a524/trail-infra-events`: **LogTrail** trail-infra-events-a524
- `n36_a524/data-reporting-store`: **DataSet** data-reporting-store-a524
- `n06_a524/trail-security-secondary`: **LogTrail** trail-security-secondary-a524
- `n22_a524/ecr-utility-image`: **EcrRepository** repo-utility-image-2-a524
- `n10_a524/s3-assets-archive`: **S3Bucket** assets-archive-a524
- `n46_a524/trail-infra-events`: **LogTrail** trail-infra-events-2-a524
- `n28_a524/sqs-notifications-stream`: **SqsQueue** notifications-stream-a524
- `n00_a524/data-reporting-store`: **DataSet** data-reporting-store-2-a524
- `n26_a524/trail-infra-events`: **LogTrail** trail-infra-events-3-a524
- `n12_a524/s3-exports-staging`: **S3Bucket** exports-staging-a524
- `n35_a524/role-metrics-collector`: **IAMRole** MetricsCollectorRole-a524
- `n05_a524/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-a524
- `n23_a524/sqs-ingest-pipeline`: **SqsQueue** ingest-pipeline-a524
- `n29_a524/data-operational-metrics`: **DataSet** data-operational-metrics-a524
- `n15_a524/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-2-a524
- `n13_a524/sqs-audit-events`: **SqsQueue** audit-events-a524
- `n11_a524/kms-storage-general`: **KmsKey** kms-storage-general-2-a524
- `n20_a524/data-reporting-store`: **DataSet** data-reporting-store-3-a524

## Relationships

- `n16_a524/acct-main` --assumes--> `n42_a524/role-developer`
- `n42_a524/role-developer` --attached_policy--> `n39_a524/pol-dev-tools`
- `n42_a524/role-developer` --assumes--> `n01_a524/role-report-builder`
- `n01_a524/role-report-builder` --assumes--> `n19_a524/role-config-sync`
- `n19_a524/role-config-sync` --assumes--> `n45_a524/role-release-orchestrator`
- `n45_a524/role-release-orchestrator` --assumes--> `n43_a524/role-app-operator`
- `n43_a524/role-app-operator` --attached_policy--> `n30_a524/pol-target-app`
- `n43_a524/role-app-operator` --can_read--> `n04_a524/s3-payroll-records`
- `n04_a524/s3-payroll-records` --stores_sensitive_data--> `n37_a524/data-payroll-records`
- `n42_a524/role-developer` --assumes--> `n02_a524/role-cost-explorer`
- `n02_a524/role-cost-explorer` --attached_policy--> `n33_a524/pol-cost-explorer-read`
- `n08_a524/role-partner-sync` --attached_policy--> `n44_a524/pol-partner-sync-read`
- `n34_a524/s3-partner-uploads` --logs_to--> `n21_a524/trail-partner-uploads`
- `n34_a524/s3-partner-uploads` --stores_sensitive_data--> `n41_a524/data-partner-uploads`
- `n40_a524/s3-app-config` --logs_to--> `n25_a524/trail-app-config`
- `n40_a524/s3-app-config` --stores_sensitive_data--> `n38_a524/data-app-config`
- `n32_a524/s3-billing-exports` --logs_to--> `n07_a524/trail-billing-exports`
- `n32_a524/s3-billing-exports` --stores_sensitive_data--> `n27_a524/data-billing-exports`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub