Lateral movement

Privileged Group – Assume Role

Risk Level

Hazardous (3)

Compliance Frameworks


An IAM Group is a collection of IAM Users. You can use groups to specify permissions for a collection of users. The group {AwsIamGroup} was found with permissive permissions that allows the user the ability to assume any role, temporarily granting them any privileges given to that role. By allowing an entity to assume any role on the account, an attacker may choose to assume a highly privileged role, which may lead to full account takeover.
  • Recommended Mitigation

    Review the group's policy and consider removing any of the following actions: sts:AssumeRole