Cloud Attack: Dissecting Attack Paths with Graph-Mode

The talk opens with definitions of threat, high value target and attack path, and argues that in cloud environments almost any identity can become a high value target. A single over-permissioned user, group or role can expose many resources, so the speaker frames identity and access management as the central control point. The explanation of AWS policies covers their statements, effects and action lists, and shows why broad read-only or wildcard grants can still help an attacker enumerate accounts and users.

The middle section works through a lab scenario in which a managed-looking policy with one permission-management action, granted on all resources and set as the default version, lets an attacker create a new policy version and widen their access, reaching organization-level control. The speaker then demonstrates an open-source graph tool built on Neo4j that queries principals, policies and statements to find such escalation paths, along with a free community edition of a commercial identity platform that visualizes attack paths and suggests remediation as infrastructure code. The question-and-answer segment covers how attack modules map specific actions to identities, and how similar reasoning could extend to other cloud platforms, CI/CD systems and directory synchronization accounts.

The takeaway for practitioners is to review cloud permissions action by action rather than by policy name, since AWS offers thousands of actions and default policy versions can quietly change what a grant allows. Graph-based views of identities and their relationships can surface chained privileges before an attacker finds them.