Privilege Escalation
lambda:CreateFunction + iam:PassRole
An attacker with lambda:CreateFunction and iam:PassRole creates a Lambda function with a privileged execution role and invokes it to run code as that role.
Required Permissions
Description
lambda:CreateFunction with iam:PassRole lets a caller stand up a new function whose execution role is any role Lambda is allowed to assume. The function runs code the attacker supplies with the credentials of that role.
The hackaws agent picks the most privileged role trusted by lambda.amazonaws.com, creates a Python function whose handler reads the execution role's credentials from the Lambda environment, invokes the function, and reads the credentials from the invocation response. The result is a short-term session that acts as the chosen role.
The hackaws agent deletes the function after use. The underlying role is not changed, so the technique is a one-shot credential grab unless the agent decides to leave the function in place.
Impact
Short-term credentials for the chosen execution role. If the role has administrator access or broad data permissions, the attacker holds the equivalent credentials.
Detection
Alert on CreateFunction events paired with PassRole on a role that was not previously used by Lambda in that account. Alert on Invoke calls on functions created within the last few minutes. Review the list of execution roles trusted by lambda.amazonaws.com for roles that grant broad access.
Mitigation
Deny iam:PassRole except for a short allowlist of execution roles that have no privileged permissions. Use a Condition on iam:PassedToService to pin the service that may receive the role. Keep privileged roles out of the trust set of lambda.amazonaws.com.