Enumerate your own tenant's permissions and find the escalation

short · 55 min · Objective 4.5

Task

Build an over-permissive policy set in a cloud account or a local simulation you own, enumerate the permissions, and find the role-assumption chain that escalates privilege — enumerating only your own tenant, then applying least privilege and confirming the chain breaks.

Steps

  1. In your own tenant, or a local simulation you built, create a policy set with an escalation path you plant: an over-broad wildcard permission, or a role-assumption chain where a low-privilege identity can assume a higher one.
  2. Enumerate the permissions of a starting identity — what it can do, what roles it can assume — recording it in /tmp/iam.md.
  3. Follow the chain: from the starting identity, assume the role it should not be able to, and record the escalation.
  4. Note any public storage or access nobody intended, which is the other common IAM finding.
  5. Apply least privilege: remove the wildcard, break the assumption chain, and confirm the escalation no longer works.
  6. Record before and after.

Verify

grep -ciE "wildcard|assume|role|over-broad|permission" /tmp/iam.md
grep -ciE "escalat|assumed|reached higher|chain" /tmp/iam.md
grep -ciE "least privilege|removed|broke the chain|no longer" /tmp/fix.md

The first count must be non-zero: you enumerated the permissions and found the over-broad grant. The second must be non-zero: you followed the assumption chain to escalate within your own tenant. The third must be non-zero: least privilege broke the chain, which is the remediation that survives a real deployment.

Notes

Enumerate your OWN tenant's permissions — the whole exercise is scoped to resources you own, because IAM enumeration against an account you do not own is exactly the offence this course refuses to teach. Over-broad policies, wildcard permissions and role-assumption chains are the common escalation paths, and public storage is the common exposure. Least privilege that survives a real deployment is the fix. Everything ran in your own tenant.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.