Identifying Cross-Account Attack Paths in AWS Environments at Scale

The talk starts from the problem that AWS resources live inside accounts, which act as security boundaries, while IAM roles can be assumed across accounts through trust policies and permissions. Chaining these assumptions lets an identity move step by step through an organization. The speaker notes that most AWS security incidents trace back to IAM, and that in environments with hundreds of accounts and thousands of roles, checking every possible assumption path by hand is impractical.

The middle of the talk reviews existing open-source options. Cartography maps resources but works only within a single account, so it misses cross-account trust. The speaker's team built IAM Graph, which takes account authorization data collected from each account, loads it into a Neo4j graph, and uses IAM Speculator-style evaluation via IAM Spy, an SMT-solver-based engine, to confirm which principals can actually assume which roles. A recorded demo showed a user in one account reaching an admin role in another account through a chain of roles.

The conclusion is that the tool has been run in environments with hundreds of accounts, where analysis takes time but works. Its purpose is to reveal unnecessary cross-account access and overly broad trust policies so they can be removed. It is not a full IAM audit tool and does not yet check for excessive permissions or privilege escalation. Future ideas include enriching the graph with data about sensitive accounts and adding queries for interesting paths. At the time, the tool was not yet public, with plans to open-source it and IAM Spy soon.