Raqib read four example authorization exports and found 83 findings across AWS, Azure, GCP, and Kubernetes, each the move an intruder would make after a foothold and the change that closes it. Filter by cloud, attacker tactic, and severity. Every reading is read only.
| Reconnaissance | Privilege | Persistence | Lateral | Exfiltration | Defense | |
|---|---|---|---|---|---|---|
| AWS 16 | 1 | 9 | 1 | 2 | 2 | 1 |
| Azure 18 | 1 | 6 | 4 | 1 | 4 | 2 |
| GCP 24 | 2 | 11 | 3 | 3 | 3 | 2 |
| Kubernetes 25 | 2 | 9 | 4 | 5 | 3 | 2 |
user billing-admin has AdministratorAccess attached, which grants full control of the account.
fixReplace the blanket grant with only the actions this principal needs. Keep administrator access to a small, monitored set of principals.
user break-glass has an Allow on action * with resource *, which is equivalent to AdministratorAccess.
fixReplace the blanket grant with only the actions this principal needs. Keep administrator access to a small, monitored set of principals.
The trust policy of role public-assumable allows any principal to assume it, with no condition to restrict it. Any AWS account can take on this role.
fixRestrict the trust policy to the specific accounts, roles, or services that should assume this role.
User ops-lead holds Owner or a role that allows every action, which is full control of everything in scope.
fixReplace Owner with a role scoped to the actions this principal needs, and keep Owner to a small, monitored set.
The project grants roles to allUsers, which means anyone on the internet, or anyone with a Google account, holds that access.
fixRemove allUsers and allAuthenticatedUsers from every binding.
user founder@example.com holds roles/owner, full control of the project including its IAM policy.
fixReplace Owner with roles scoped to what this member needs, and keep Owner to a small, monitored set.
User break-glass is bound to a role with every verb on every resource across the cluster, which is full control.
fixBind cluster-admin to as few subjects as possible, and give everyone else a role scoped to what they do.
user bounded-operator has an Allow on action * with resource *, which is equivalent to AdministratorAccess. A permissions boundary (s3-only-boundary) is attached, so effective permissions are limited to the boundary rather than the whole account. Verify the boundary.
fixReplace the blanket grant with only the actions this principal needs. Keep administrator access to a small, monitored set of principals.
user policy-editor can launch an instance with a powerful instance profile and use its credentials.
fixScope iam:PassRole to specific low privilege roles, and restrict ec2:RunInstances.
user ci-deployer can create a function with a powerful execution role and invoke it to act as that role.
fixScope iam:PassRole to specific execution roles, and separate function creation from function invocation.
user secrets-reader can read every secret in Secrets Manager, and read every SSM parameter. An intruder holding this principal would use it to pull data out.
fixScope these actions to the specific secrets, buckets, parameters, and tables the principal needs, and never to all of them.
role public-assumable can read objects in any bucket. An intruder holding this principal would use it to pull data out.
fixScope these actions to the specific secrets, buckets, parameters, and tables the principal needs, and never to all of them.
user policy-editor can create a new default version of a customer managed policy the principal is attached to and write administrator permissions into it.
fixRemove iam:CreatePolicyVersion, or scope it to policies that grant no access this principal lacks.
user policy-editor can set an older, more permissive version of an attached policy as the default.
fixRemove iam:SetDefaultPolicyVersion unless it is scoped to policies that cannot raise this principal's access.
user log-manager can stop or delete CloudTrail, stop or delete Config recording, and disable or delete GuardDuty. An intruder holding this principal would use it to reduce or erase the record of what they did.
fixRemove these actions from the principal, and protect logging with an organization policy so a single account cannot turn it off.
user iam-admin is allowed iam:* , every action in a sensitive service on resource *.
fixList only the iam actions this principal uses instead of the iam:* wildcard.
User fedcred-writer can add a federated identity credential to a user assigned managed identity, letting an external OIDC issuer authenticate as that identity with no secret to rotate.
fixRestrict federatedIdentityCredentials writes, and review the trust of every federated credential.
User identity-assigner can assign a user assigned managed identity to a resource it controls, then run as that identity.
fixRestrict the assign action on user assigned managed identities to the members that provision them.
ServicePrincipal ci-sp can write role assignments, so it can assign itself Owner and take full control.
fixRemove Microsoft.Authorization/roleAssignments/write, or limit it to a narrow scope under review.
User storage-user can list storage account keys, which opens every blob and file in the account. An intruder holding this principal would use it to pull data out.
fixScope storage, Key Vault, disk, and database access to the specific resources the principal needs.
User sas-minter can mint a SAS token that shares a storage account out. An intruder holding this principal would use it to pull data out.
fixScope storage, Key Vault, disk, and database access to the specific resources the principal needs.
User disk-exporter can export a disk or snapshot as a downloadable image. An intruder holding this principal would use it to pull data out.
fixScope storage, Key Vault, disk, and database access to the specific resources the principal needs.
ServicePrincipal cosmos-reader can read Cosmos DB keys, which open every database in the account. An intruder holding this principal would use it to pull data out.
fixScope storage, Key Vault, disk, and database access to the specific resources the principal needs.
ServicePrincipal automation-sp can write and run an Automation runbook, which executes as the managed identity of the Automation account.
fixRestrict runbook writes, and scope the Automation account managed identity to what its runbooks need.
User vm-operator can run a command or install an extension on a virtual machine, executing as the managed identity attached to that VM.
fixRestrict runCommand and extension writes, and avoid attaching privileged managed identities to general purpose VMs.
User log-eraser can delete diagnostic settings, and delete Log Analytics workspaces. That is how an intruder reduces or erases the record of what they did.
fixRemove these delete permissions, and protect logging with an Azure policy so it cannot be turned off in one place.
User defender-downgrader can lower the Microsoft Defender for Cloud plan, turning off threat detection. That is how an intruder reduces or erases the record of what they did.
fixRemove these delete permissions, and protect logging with an Azure policy so it cannot be turned off in one place.
service account 123456789-compute@developer.gserviceaccount.com is a default service account with Editor or Owner. It is attached to compute by default, so a foothold on a VM or a function inherits this reach.
fixRemove the broad role from the default service account, run workloads as a dedicated least privilege service account, and disable default service account grants.
service account ci@project.iam.gserviceaccount.com can create keys for service accounts. A service account key is a long lived credential an intruder can take away and keep using.
fixRemove roles/iam.serviceAccountKeyAdmin, and prefer short lived credentials over keys.
service account fn-deploy@project.iam.gserviceaccount.com can act as a service account and create a Cloud Function, which then runs with that account permissions. This is the GCP form of passing a role.
fixSeparate serviceAccountUser from deploy permissions, and grant it only on the specific service accounts a task needs.
user dm-deployer@example.com can create a Deployment Manager deployment, which runs as the Google APIs service account, an Editor on the project by default.
fixRestrict deploymentmanager.deployments.create, and run deployments with a scoped service account.
user deployer@example.com can mint tokens for or sign as a service account, borrowing the access of a more powerful one.
fixRemove roles/iam.serviceAccountTokenCreator unless this member must impersonate a specific service account.
user token-signer@example.com can mint tokens for or sign as a service account, borrowing the access of a more powerful one.
fixRemove roles/iam.serviceAccountTokenCreator unless this member must impersonate a specific service account.
user app-dev@example.com can read secrets in Secret Manager, across the project rather than a named resource.
fixGrant data access on specific buckets, secrets, and datasets, not at the project level.
user hmac-user@example.com can create storage HMAC keys, interoperable credentials that read Cloud Storage from anywhere, across the project rather than a named resource.
fixGrant data access on specific buckets, secrets, and datasets, not at the project level.
user role-admin@example.com can update a custom role, so it can add permissions to a role granted to itself.
fixRemove roles/iam.roleAdmin unless this member curates custom roles, and keep it off members the role is granted to.
user platform@example.com can set the project IAM policy, so it can grant itself Owner and take full control.
fixRemove the setIamPolicy permission, granted by roles such as Owner, Security Admin, or Project IAM Admin, unless this member administers IAM.
user cloud-builder@example.com can start a Cloud Build build, whose steps run as the Cloud Build service account, an Editor on the project by default.
fixRestrict cloudbuild.builds.create, and lower the Cloud Build service account from Editor to what builds actually need.
user ops@example.com can delete log sinks or logs, and redirect log routing by updating a sink, which is how an intruder stops or erases the record of what they did.
fixRemove roles/logging.admin and roles/monitoring.admin from principals that do not run them, and route audit logs to a sink another team controls.
user monitoring-admin@example.com can delete alerting policies so nothing fires, which is how an intruder stops or erases the record of what they did.
fixRemove roles/logging.admin and roles/monitoring.admin from principals that do not run them, and route audit logs to a sink another team controls.
User rbac-editor-user holds the bind verb, which lets it bind itself to a more powerful role such as cluster-admin.
fixRemove the bind verb from this subject's roles.
User cluster-binder-user can create cluster role bindings, so it can bind a subject it controls to a powerful role and keep access.
fixRemove create on clusterrolebindings unless this subject administers RBAC.
User deployer can create pods in any namespace, which can mount a host path or a powerful service account and reach the node.
fixScope pod creation to the namespaces a workload needs, and enforce a pod security standard.
User workload-deployer can create or change workload controllers such as deployments and daemonsets, which spawn pods that can mount a host path or a powerful service account and reach the node.
fixScope workload creation to the namespaces a team owns, and enforce a pod security standard.
User rbac-editor-user holds the escalate verb on roles, which lets it write a role granting more than it already has.
fixRemove the escalate verb from this subject's roles.
User debugger can exec into or attach to running pods, taking over a workload and the service account token mounted in it.
fixRemove exec and attach on pods unless debugging a namespace requires it.
User support-agent can impersonate users, groups, or service accounts, acting with their access.
fixRemove the impersonate verb unless this subject must act on behalf of others.
ServiceAccount operator can create admission webhook configurations, which run on every future API request and are a durable and stealthy foothold.
fixRestrict who can create webhook configurations to cluster operators.
User cert-issuer can create certificate signing requests and approve them, minting a client certificate for any user or group, including one in a privileged group.
fixSeparate creating certificate signing requests from approving them, and keep approval to the control plane.
ServiceAccount issuer can create tokens for service accounts, minting a credential for a more powerful identity.
fixRemove create on serviceaccounts/token unless this subject issues tokens for a workload.
Group readers can proxy to the kubelet API on nodes, which runs commands in the pods on a node and reads their logs and mounted tokens, a route off one workload onto others.
fixRemove nodes/proxy unless a controller genuinely needs it.
User node-reacher can proxy to the kubelet API on nodes, which runs commands in the pods on a node and reads their logs and mounted tokens, a route off one workload onto others.
fixRemove nodes/proxy unless a controller genuinely needs it.
ServiceAccount audit-sa can read secrets in every namespace. Secrets hold service account tokens, so this is a route into other namespaces and workloads.
fixScope secret access to the namespace a workload runs in.
Group readers can read secrets in every namespace. Secrets hold service account tokens, so this is a route into other namespaces and workloads.
fixScope secret access to the namespace a workload runs in.
user identity-provisioner can create IAM users. On its own that is limited, but paired with a way to grant access it becomes a back door.
fixLimit iam:CreateUser to the principals that provision identities, and watch for new users.
user recon-bot can call iam:GetAccountAuthorizationDetails, which returns every user, role, group, and policy in one response. It is the first thing an intruder pulls to plan a path, the same export this report is built from.
fixLimit this action to the small set of principals that audit IAM, and watch for it in the trail.
user support-agent can reset the console password of a more privileged user and sign in as them. The grant is scoped to specific resources, so confirm the scope does not include a target more privileged than this principal.
fixScope iam:UpdateLoginProfile to the principal's own user.
The trust policy of role partner-access allows arn:aws:iam::999988887777:root to assume it. If that account is a third party, a missing external id lets a confused deputy assume the role on a caller's behalf.
fixConfirm the account is one you control or a trusted partner, and require an external id condition for third party access.
User automation-author can create an Automation account, a durable and scheduled execution surface that can run as a managed identity.
fixLimit who can create Automation accounts, and review their runbooks and identities.
ServicePrincipal mi-creator can create user assigned managed identities, a durable identity an intruder can attach to compute and return through.
fixLimit creation of managed identities to the principals that provision them.
ServicePrincipal ci-sp can create role assignments, which lets an intruder grant a principal they control lasting access.
fixAlert on new role assignments and keep this permission narrow.
User role-author can create or change role definitions. Paired with a way to assign them it becomes escalation.
fixLimit Microsoft.Authorization/roleDefinitions/write to role administrators.
ServicePrincipal cross-sub-sp holds roles in more than one subscription (sub-1, sub-2). One compromised identity reaches across those subscriptions.
fixConfirm this identity needs access in every subscription, and split its roles per subscription where you can.
group platform-team@example.com is a group granted Owner or Editor. The membership is managed outside the project, so who holds this access is not visible in the IAM policy.
fixConfirm the group membership is controlled and reviewed, and prefer scoped roles over Owner or Editor on a group.
service account sa-user@project.iam.gserviceaccount.com can attach a service account to a resource it creates and run as that account. Paired with deploy access it becomes escalation.
fixGrant roles/iam.serviceAccountUser only on the specific service accounts a task needs.
service account 123456789-compute@developer.gserviceaccount.com can attach a service account to a resource it creates and run as that account. Paired with deploy access it becomes escalation.
fixGrant roles/iam.serviceAccountUser only on the specific service accounts a task needs.
group platform-team@example.com can attach a service account to a resource it creates and run as that account. Paired with deploy access it becomes escalation.
fixGrant roles/iam.serviceAccountUser only on the specific service accounts a task needs.
user sa-binder@example.com can set the IAM policy on a service account, binding a principal it controls as a token creator, a stealthy back door into that identity.
fixRestrict iam.serviceAccounts.setIamPolicy, and review who is bound on high value service accounts.
user scheduler-admin@example.com can create Cloud Scheduler jobs, a timer an intruder can use to trigger a callback again and return.
fixLimit cloudscheduler.jobs.create, and review scheduled jobs for unexpected targets.
user db-exporter@example.com can export a Cloud SQL database to a bucket, across the project rather than a named resource.
fixGrant data access on specific buckets, secrets, and datasets, not at the project level.
User ns-binder can create role bindings in any namespace, binding a subject it controls to a role and keeping a foothold in that namespace.
fixScope rolebinding creation to the namespaces a team owns.
ServiceAccount sa-maker can create service accounts, a fresh identity an intruder can stand up, bind, and return through.
fixLimit create on serviceaccounts to the namespaces and operators that provision workloads.
User tunneler can port forward to pods, opening a tunnel to a pod and any service reachable from it.
fixRemove pods/portforward unless debugging a namespace requires it.
Group readers can read every secret in the cluster, read every config map, and read pod logs, which leak secrets, tokens, and data, across every namespace.
fixScope config map, secret, and log access to the namespace a workload needs.
User config-viewer can read every config map, across every namespace.
fixScope config map, secret, and log access to the namespace a workload needs.
User log-reader-user can read pod logs, which leak secrets, tokens, and data, across every namespace.
fixScope config map, secret, and log access to the namespace a workload needs.
ServiceAccount operator can delete admission webhook configurations that enforce policy.
fixRemove delete on events and webhook configurations from workloads, and ship audit logs off the cluster.
ServiceAccount janitor can delete events, the cluster's own record of what happened.
fixRemove delete on events and webhook configurations from workloads, and ship audit logs off the cluster.
User read-only can read every resource under a management group, a full map of the estate.
fixGrant Reader at the narrowest scope a task needs.
user security-reviewer@example.com can read the project IAM policy, every member and the roles they hold, the map an intruder draws before choosing a target.
fixLimit resourcemanager.projects.getIamPolicy to the members that audit access.
user analyst@example.com can read every resource in the project, a full map of what is there.
fixGrant read access at the narrowest scope a task needs rather than project wide Viewer.
Group readers can list or get every resource in every namespace, a full map of the cluster.
fixScope read access to the namespaces and resource types a subject needs.
User rbac-viewer-user can read the roles and bindings across the cluster, mapping who can do what, the first thing an intruder reads to plan a path.
fixLimit read of RBAC resources to the subjects that audit access.