release: v2.1.0 - 64 IAM escalation methods, full pathfinding.cloud coverage

Tier 1 (20 action-based methods): PassRole variants for Glue/ECS/CloudFormation,
EC2 instance profile hijack, Lambda resource policy abuse, IAM deny-removal,
MFA bypass paths.

Tier 2 (12 methods, +1 new category COMPUTE_HIJACK): PassRole+CodeBuild/AppRunner/
SageMaker/Bedrock/StepFunctions, SSM compute hijack (SendCommand/StartSession/
GetParameter), EC2 Instance Connect SSH key push, hijack of existing CodeBuild
projects and AppRunner services.

Tier 3 (4 lateral methods, +1 new category LATERAL_ASSUME_ROLE): trust policy
graph traversal in new module iam_trust_graph.py. Detects AssumeRole:Direct
(1-hop to admin), AssumeRole:Chain (multi-hop), AssumeRole:WildcardTrust
(Principal:*), and AssumeRole:CrossAccountRoot (external account root).
Same-account-root expansion semantics, bare account ID normalization,
conditions flagged but not evaluated (lightweight unlike PMapper).

Plus 3 post-benchmark methods: glue:UpdateDevEndpoint, sagemaker:CreatePresigned
NotebookUrl, PassRole+SageMaker:CreateTrainingJob - for parity with Bishop Fox
iam-vulnerable test bench.

Total: 60 action-based + 4 lateral = 64 detection methods across 9 categories
(was 25/6 in v2.0). 142 new tests added (496 -> 638 total).

Author: gebalamariusz

CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.1.0] - 2026-04-28
+
+### Added
+
+- **IAM Privilege Escalation - Tier 1 + Tier 2 + Tier 3**: 39 new detection methods, total 64 across 9 categories (was 25/6). Coverage of all known IAM privilege escalation paths in pathfinding.cloud.
+
+  Tier 1 (20 methods - PassRole variants + resource policy abuse + deny removal):
+  - PassRole + Glue variants: `glue:CreateJob`, `glue:UpdateJob`, `glue:CreateSession`
+  - PassRole + ECS variants: `ecs:UpdateService`, `ecs:RegisterTaskDefinition` (auto-deploy)
+  - PassRole + CloudFormation: `cloudformation:UpdateStack`
+  - PassRole + EC2 instance profile hijack: `ec2:AssociateIamInstanceProfile`, `ec2:ReplaceIamInstanceProfileAssociation`
+  - PassRole + Lambda event source mapping
+  - Instance profile role swap (no PassRole): `iam:RemoveRoleFromInstanceProfile` + `iam:AddRoleToInstanceProfile`
+  - **NEW Resource Policy Abuse category**: `lambda:AddPermission`, `lambda:AddLayerVersionPermission`
+  - IAM deny-removal patterns: `iam:DeleteRolePolicy`, `iam:DeleteUserPolicy`, `iam:DetachRolePolicy`, `iam:DetachUserPolicy`, `iam:CreateServiceLinkedRole`
+  - Credential access extensions: `iam:UpdateAccessKey`, `iam:DeactivateMFADevice`, `iam:DeleteVirtualMFADevice` (MFA bypass paths)
+
+  Tier 2 (12 methods - new compute primitives + SSM):
+  - PassRole + new services: `codebuild:CreateProject`, `apprunner:CreateService`, `sagemaker:CreateNotebookInstance`, `sagemaker:CreateProcessingJob`, `bedrock:CreateAgent`, `states:CreateStateMachine`
+  - **NEW Compute Hijack category**: `ssm:SendCommand`, `ssm:StartSession` (managed EC2 abuse), `ec2-instance-connect:SendSSHPublicKey` (60s SSH key push), `codebuild:UpdateProject` (hijack existing CI build), `apprunner:UpdateService` (replace running container)
+  - Credential access extension: `ssm:GetParameter` (read secrets from Parameter Store)
+
+  Tier 3 (4 methods - lateral movement via AssumeRole graph - NEW pipeline):
+  - **NEW Lateral AssumeRole category** with new module `iam_trust_graph.py` parsing `AssumeRolePolicyDocument` and building a directed graph
+  - `AssumeRole:Direct` - 1-hop assume from a principal to a role with admin permissions
+  - `AssumeRole:Chain` - multi-hop assume chain (up to 4 hops) ending at admin
+  - `AssumeRole:WildcardTrust` - any role with `Principal: "*"` trust policy
+  - `AssumeRole:CrossAccountRoot` - any role trusting external account `:root`
+  - Same-account root expansion: roles trusting `arn:aws:iam::SAME:root` are reachable by any principal in account with `sts:AssumeRole`
+  - Bare 12-digit account IDs are normalized to `:root` ARNs
+  - Trust conditions (MFA / ExternalId / SourceArn) are flagged but not semantically evaluated
+
 ## [2.0.1] - 2026-04-17
 
 ### Changed

README.md

@@ -103,7 +103,7 @@ cloud-audit simulate --fix aws-vpc-002
 
 | Feature | What it does |
 |---|---|
-| **IAM Privilege Escalation** | 25 escalation methods across 6 categories. PMapper has been dead since 2022 -- this is its open-source replacement. |
+| **IAM Privilege Escalation** | 61 escalation methods across 9 categories, including lateral movement detection via AssumeRole graph traversal. PMapper has been dead since 2022 -- this is its open-source replacement, and it covers paths PMapper never did. |
 | **What-If Simulator** | `cloud-audit simulate --fix aws-vpc-002` shows score change, chains broken, and risk reduction before you apply anything. |
 | **Root Cause Grouping** | "Fix 4 things, break 22 chains." Groups findings by shared root cause and ranks by impact. |
 | **Security Posture Trend** | `cloud-audit trend` tracks health score, chains, and risk over time with sparkline visualization. |
@@ -191,7 +191,7 @@ cloud-audit is AWS-only and intentionally narrower (94 curated checks). It goes
 | Compliance frameworks (AWS) | 41 (CIS, PCI-DSS, HIPAA, SOC2, NIST, ISO 27001, GDPR, FedRAMP, NIS2, ...) | 6 (CIS v3.0, SOC 2, BSI C5, ISO 27001, HIPAA, NIS2) |
 | Auto-remediation | 55 fixers across 17 AWS services (direct API calls) | 94/94 findings with CLI + Terraform output (reviewable, you apply) |
 | Attack path / graph analysis | Prowler App (Cartography + graph queries) | CLI-native (31 rules, no infra) |
-| IAM privilege escalation graph | Prowler App | CLI-native (25 methods) |
+| IAM privilege escalation graph | Prowler App | CLI-native (61 methods + AssumeRole graph) |
 | What-If remediation simulator | No | Yes |
 | AI/ML security checks (Bedrock + SageMaker) | ~20 checks | 5 checks + 3 attack chain rules |
 | Scan diff / drift tracking | Prowler App | Built-in CLI (`cloud-audit diff`) |
@@ -323,7 +323,7 @@ Full docs at **[haitmg.pl/cloud-audit](https://haitmg.pl/cloud-audit/)**:
 
 - **[Getting Started](https://haitmg.pl/cloud-audit/getting-started/installation/)** - installation, quick start, demo mode
 - **[Attack Chains](https://haitmg.pl/cloud-audit/features/attack-chains/)** - all 31 rules with MITRE ATT&CK references
-- **[IAM Escalation](https://haitmg.pl/cloud-audit/features/iam-escalation/)** - 25 methods, 6 categories
+- **[IAM Escalation](https://haitmg.pl/cloud-audit/features/iam-escalation/)** - 61 methods, 9 categories (action-based + lateral AssumeRole graph)
 - **[What-If Simulator](https://haitmg.pl/cloud-audit/features/simulate/)** - simulate remediation impact
 - **[Compliance](https://haitmg.pl/cloud-audit/compliance/overview/)** - 6 frameworks: CIS, SOC 2, BSI C5, ISO 27001, HIPAA, NIS2
 - **[All 94 Checks](https://haitmg.pl/cloud-audit/checks/)** - full check reference by service

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cloud-audit"
-version = "2.0.1"
+version = "2.1.0"
 description = "Open-source AWS security scanner with IAM escalation detection, What-If simulator, security trends, AI-SPM (Bedrock/SageMaker), 6 compliance frameworks, 31 attack chain rules, breach cost estimation, and MCP server. 94 checks across 23 services. Every finding includes CLI + Terraform remediation."
 readme = "README.md"
 license = "MIT"

src/cloud_audit/models.py

@@ -123,6 +123,9 @@ class EscalationCategory(str, Enum):
     LAMBDA_CODE_MOD = "lambda_code_modification"
     TRUST_POLICY_ABUSE = "trust_policy_abuse"
     PERMISSION_BOUNDARY = "permission_boundary_bypass"
+    RESOURCE_POLICY_ABUSE = "resource_policy_abuse"
+    COMPUTE_HIJACK = "compute_hijack"
+    LATERAL_ASSUME_ROLE = "lateral_assume_role"
 
 
 class EscalationPath(BaseModel):

src/cloud_audit/providers/aws/checks/iam.py

@@ -1256,6 +1256,63 @@ def check_privilege_escalation(provider: AWSProvider) -> CheckResult:
                     f'# Action = ["{path.required_actions[0]}"]\n'
                     f'# Effect = "Deny"'
                 )
+            elif path.category.value == "resource_policy_abuse":
+                cli_fix = (
+                    f"# Restrict {path.required_actions[0]} for {path.principal_type.lower()} "
+                    f"'{path.principal_name}':\n"
+                    f"# Resource policy modifications enable cross-account/cross-principal abuse.\n"
+                    f"# Scope this action to specific function/layer ARNs or remove entirely."
+                )
+                tf_fix = (
+                    f"# Deny resource policy abuse via SCP or permission boundary:\n"
+                    f'# Action = ["{path.required_actions[0]}"]\n'
+                    f'# Effect = "Deny"'
+                )
+            elif path.category.value == "compute_hijack":
+                cli_fix = (
+                    f"# Restrict {', '.join(path.required_actions)} for "
+                    f"{path.principal_type.lower()} '{path.principal_name}':\n"
+                    f"# These actions allow taking over existing compute that holds a privileged role.\n"
+                    f"# Scope to specific instance/project/service ARNs and require MFA where possible."
+                )
+                tf_fix = (
+                    f"# Limit compute-hijack actions via permission boundary or SCP:\n"
+                    f"# Action = {path.required_actions}\n"
+                    f'# Effect = "Deny"\n'
+                    f'# Condition = {{ Bool = {{ "aws:MultiFactorAuthPresent" = "false" }} }}'
+                )
+            elif path.category.value == "lateral_assume_role":
+                cli_fix = (
+                    f"# Tighten trust policy on role '{path.principal_name}':\n"
+                    f"# 1. Replace wildcard/root principals with specific ARNs.\n"
+                    f"# 2. Add sts:ExternalId condition for cross-account roles.\n"
+                    f"# 3. Require aws:MultiFactorAuthPresent = true for sensitive roles.\n"
+                    f"# Update via: aws iam update-assume-role-policy "
+                    f"--role-name {path.principal_name} --policy-document file://trust-policy.json"
+                )
+                tf_fix = (
+                    "# Example hardened trust policy (replace with concrete principals):\n"
+                    'data "aws_iam_policy_document" "assume_role" {\n'
+                    "  statement {\n"
+                    '    effect = "Allow"\n'
+                    "    principals {\n"
+                    '      type        = "AWS"\n'
+                    '      identifiers = ["arn:aws:iam::ACCOUNT:role/specific-caller"]\n'
+                    "    }\n"
+                    '    actions = ["sts:AssumeRole"]\n'
+                    "    condition {\n"
+                    '      test     = "StringEquals"\n'
+                    '      variable = "sts:ExternalId"\n'
+                    '      values   = ["unique-shared-secret"]\n'
+                    "    }\n"
+                    "    condition {\n"
+                    '      test     = "Bool"\n'
+                    '      variable = "aws:MultiFactorAuthPresent"\n'
+                    '      values   = ["true"]\n'
+                    "    }\n"
+                    "  }\n"
+                    "}"
+                )
             else:
                 cli_fix = (
                     f"# Remove {', '.join(path.required_actions)} from "