Persistence

General Knowledge
• Connection Tracking
• IAM ID Identifiers
Enumeration
• Enumerate Permissions without Logging to CloudTrail
• Get Account ID from AWS Access Keys
• Unauthenticated Enumeration of IAM Users and Roles
• Whoami - Get Principal Name From Keys
Exploitation
• Local Privilege Escalation: User Data
• Local Privilege Escalation: User Data 2
• Steal EC2 Metadata Credentials via SSRF
• Steal IAM Credentials and Event Data from Lambda
Avoid Detection
• Bypass Credential Exfiltration Detection
• Bypass GuardDuty Pentest Findings
Persistence
• AWS Consoler
• Role Chain Juggling