IAM Privilege Escalation Risk Detector

IAM Privilege Escalation Risk Detector checks a pasted IAM policy against a curated catalog of published, well-known privilege-escalation technique combinations — action sets that, when granted together to one principal, let that principal expand its own permissions beyond what was intended. This is the same style of check performed by open-source tools like PMapper and cloudsplaining, built on defensive security research originally popularized by Rhino Security Labs.

For each catalog entry, the detector checks whether every required action in that combination is granted somewhere among the policy's Allow statements — wildcard-aware, so a broad grant like iam:* is correctly recognized as covering a specific requirement like iam:CreateAccessKey. A match means the ingredients for that particular escalation path are all present in this policy; it does not by itself confirm the path is exploitable in your account, since that also depends on how each action's Resource is scoped and what other roles exist for a principal to pivot into.

The pattern catalog is deliberately fixed and non-exhaustive — it covers known, published techniques, not every conceivable way a policy could be misused. A clean result means no known pattern from this specific catalog was matched; it is not a certification that the policy is free of privilege-escalation risk. The full catalog is shown below the results so you can see exactly what this tool does and does not check for, even before you run anything.

• 19 published privilege-escalation patterns checked automatically.
• Wildcard-aware matching — iam:* correctly covers narrower required actions.
• Exact action combo shown per matched pattern, plus a plain-English description of the escalation path.
• Clear "no known patterns matched" success state — never silent on a clean result.
• Full reference catalog expandable below the results, so you can see everything checked even before pasting a policy.
• 100% client-side — nothing is uploaded.

1. Paste an IAM policy document, or click the sample to load a policy that triggers a known pattern.
2. Click Detect.
3. Review each matched pattern — its name, the exact actions it requires, and what the escalation path lets a principal do.
4. Expand the reference catalog to see every pattern this tool checks against, whether or not it matched.

Example 1 — classic Lambda escalation. A policy granting iam:PassRole, lambda:CreateFunction, and lambda:InvokeFunction together → matched: create a function with a passed role, then invoke it to run code under that role's permissions.

Example 2 — broad IAM wildcard. A policy granting iam:* → matches several single-action patterns at once (e.g. CreateAccessKey, AttachUserPolicy), since the wildcard covers all of them.

Example 3 — one unrelated action. A policy granting only s3:GetObject → no patterns matched; the tool reports a clear success state rather than staying silent.

• Screens for the specific action combinations attackers actually use, not just broad wildcards.
• Explains each match in plain English, including exactly which actions triggered it.
• Transparent catalog — see the full pattern list, not a black box.
• Private — the policy never leaves your browser.