# Cloud Iam Audit

云 IAM 权限审计与提权。当获取了云平台凭据（AWS AK/SK、Azure SPN、GCP SA、腾讯云...

- Repository: https://github.com/wgpsec/AboutSecurity (1833 stars)
- Category: DevOps
- License: see repository
- Last updated: 2026-10-24
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add wgpsec/AboutSecurity --skill cloud-iam-audit -g -a claude-code -y`
Codex: `npx skills add wgpsec/AboutSecurity --skill cloud-iam-audit -g -a codex -y`
Cursor: `npx skills add wgpsec/AboutSecurity --skill cloud-iam-audit -g -a cursor -y`
Gemini CLI: `npx skills add wgpsec/AboutSecurity --skill cloud-iam-audit -g -a gemini-cli -y`

## Description

云 IAM 权限审计与提权。当获取了云平台凭据（AWS AK/SK、Azure SPN、GCP SA、腾讯云 SecretId/SecretKey）需要评估权限范围和提权路径时使用。覆盖 AWS/Azure/GCP/腾讯云的 IAM/CAM 策略分析、常见提权路径（PassRole、AssumeRole、Lambda/SCF 提权）、跨账号攻击、CloudTrail/CloudAudit 规避。发现任何云凭据、AK/SK、SecretId/SecretKey 时都应使用此技能

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# 云 IAM 权限审计与提权方法论

IAM/CAM 权限就是攻击面, , 一个过度授权的策略比一个 RCE 漏洞更危险。

## ⛔ 深入参考（必读）

- AWS 5 条提权路径详细命令、高价值数据搜索、CloudTrail 隐蔽性 → [references/aws-escalation.md](references/aws-escalation.md)
- 腾讯云 CAM 提权路径、tccli/SDK 命令、CloudAudit 隐蔽性 → [references/tencent-cam-escalation.md](references/tencent-cam-escalation.md)

---

## Phase 1: 凭据识别与身份确认

| 凭据 | 格式 | 来源 |
|------|------|------|
| AWS AK/SK | `AKIA...` (20字符) | 配置文件、环境变量、元数据 |
| AWS 临时凭据 | `ASIA...` + SessionToken | IMDS、STS AssumeRole |
| Azure SPN | client_id + client_secret + tenant_id | 配置文件 |
| GCP SA Key | JSON 文件含 `private_key` | 服务账号密钥文件 |
| 腾讯云 SecretId/SecretKey | `AKIDz...` (36字符) / `xxx=` (Base64) | 配置文件、环境变量、元数据 |
| 腾讯云临时凭据 | SecretId/SecretKey + Token/ExpiredTime | 元数据、STS AssumeRole |

```bash
# AWS: 我是谁
aws sts get-caller-identity

# Azure
az account show

# GCP
gcloud auth list

# 腾讯云: 我是谁（优先使用 tccli）
tccli sts GetCallerIdentity
# 或使用 SDK
python3 -c "
from tencentcloud.sts.v20180813 import sts_client, models
from tencentcloud.common import credential
cred = credential.Credential('SecretId', 'SecretKey')
client = sts_client.StsClient(cred, 'ap-guangzhou')
print(client.GetCallerIdentity(models.GetCallerIdentityRequest()).to_json_string())
"
```

### 腾讯云凭据配置

```bash
# 交互式配置 tccli（优先）
tccli configure
# 输入: SecretId, SecretKey, Region(如 ap-guangzhou), Output(json)

# 使用临时凭据时需额外设置 Token
tccli configure set token "TOKEN_VALUE"

# 也可通过环境变量设置
export TENCENTCLOUD_SECRET_ID="AKIDz..."
export TENCENTCLOUD_SECRET_KEY="xxxx="
export TENCENTCLOUD_SESSION_TOKEN="TOKEN"  # 临时凭据时
```

---

## Phase 2: 权限枚举

### AWS 权限枚举
```bash
aws iam list-attached-user-policies --user-name <user>
aws iam list-attached-role-policies --role-name <role>
# 暴力枚举
aws s3 ls 2>&1; aws ec2 describe-instances 2>&1; aws iam list-users 2>&1
```

### 腾讯云 CAM 权限枚举（tccli 优先）

```bash
# 1. 账户概览
tccli cam GetAccountSummary

# 2. 列出子用户
tccli cam ListUsers

# 3. 列出用户组
tccli cam ListGroups --Page 1 --Rp 50

The rest: https://github.com/wgpsec/AboutSecurity/blob/HEAD/skills/cloud/cloud-iam-audit/SKILL.md