Privilege Escalation (Cloud)

Cloud privilege escalation refers to techniques where an attacker with limited cloud permissions gains higher privileges by exploiting misconfigurations in IAM policies, resource-based policies, or trust relationships. Common paths include using `iam:CreatePolicyVersion` to replace an existing policy, assuming a more privileged role via `sts:AssumeRole`, or exploiting `lambda:UpdateFunctionCode` to modify a Lambda function's execution role.

CIEM tools model these privilege escalation paths to proactively identify and remediate high-risk permission combinations.