An IAM Misconfiguration That Let a Developer Become Admin

Overview

Three ordinary-looking Lambda permissions added up to full admin access, and a contractor's scanner found it before anyone used it.

What happened

A routine IAM access review turned up a platform developer with iam:PassRole, lambda:CreateFunction and lambda:InvokeFunction. For someone who managed Lambda deployments, each looked reasonable. The review first missed that together they allow full privilege escalation.

Why it broke

A role with AdministratorAccess already existed for production deployments. Any principal allowed to pass it to a new function could borrow its power.

> [!IMPORTANT] Review permissions as combinations. None of the three is dangerous alone; together they are an admin grant.

The fix

• Developer holds iam:PassRole — iam:PassRole revoked from the developer's policy
• Roles passable to Lambda carry their full permissions — A permission boundary on every role that can be passed to Lambda

Key concepts

Privilege escalation

Using a combination of allowed permissions to gain capabilities beyond what was explicitly granted — often by creating or modifying resources that operate with higher permissions.

iam:PassRole

A permission that allows attaching an IAM role to a service. Combined with resource creation permissions, it is a common escalation vector.

Permission boundary

An IAM policy attached to a role that sets the maximum permissions the role can have — even if a broader policy is attached, the boundary limits effective permissions.

Cloudsplaining

An open-source tool that analyzes IAM policies and identifies privilege escalation paths, resource exposure, and overly broad permissions.

When to use it

• Explaining IAM least privilege and indirect privilege escalation risks
• Discussing permission boundaries as a defense against escalation
• Justifying automated IAM auditing in security programs

Interview questions

• How do you prevent IAM privilege escalation through Lambda and iam:PassRole?

More War Stories topics

• A Deployment That Could Not Be Rolled Back
• A Failed Migration That Left the Database in a Partial State
• A Feature Flag Change That Triggered a Production Outage
• Accidental DELETE Without a WHERE Clause in Production
• AWS Credentials Committed to a Public GitHub Repository
• Backups That Were Never Actually Completing
• BGP Route Leak That Rerouted Traffic Through an Unexpected AS
• Blue-Green Deployment That Resulted in Split-Brain Sessions
• Cache Stampede on a Flash-Sale Product Page
• Connection Pool Exhaustion That Brought Down 12 Microservices
• DynamoDB Hot Partition That Throttled a Flash Sale
• Failover to a Lagging Replica Lost 4 Minutes of Orders