Dangerous
aws iam attach-user-policy --user-name svc-deploy --policy-arn arn:aws:iam::aws:policy/AdministratorAccesscross-platform · bash · Intermediate
Grants a service account full administrative rights across the AWS account. It is an ordinary, well-formed API call with no shell metacharacters at all, and the only signal is recognising what that particular policy ARN confers.
Signals to notice
- Attaches AdministratorAccess to a service principal
- Account-wide privilege escalation
- Looks like routine IAM administration
Think you can spot these under time pressure?
Start TrainingMore Cloud
terraform plan -out=tfplanExpertaz account show --query id -o tsvExpertaws ec2 authorize-security-group-ingress --group-id sg-0a1b2c3d --protocol tcp --port 22 --cidr 0.0.0.0/0Expertaws iam attach-role-policy --role-name build-runner --policy-arn arn:aws:iam::aws:policy/AdministratorAccessAdvancedaws iam put-role-policy --role-name build-runner --policy-name artifacts-write --policy-document file://./policy/artifacts-write.jsonIntermediateterraform apply -auto-approveExpert