Question

During a cloud-focused engagement, you obtain a set of AWS access keys from a compromised developer laptop. Before pivoting, you want to passively determine which permissions the key set actually holds without triggering obvious changes to the environment. Which action is the MOST appropriate first step to enumerate the effective permissions of these credentials?

Accepted Answer

Run 'aws iam get-account-authorization-details' and iterate through returned policies to map the identity's attached and inline permissions

Answer

Attempt 'aws ec2 run-instances' with a minimal instance type to confirm compute privileges

Answer

Use 'aws iam create-access-key' to generate a second key for persistence before enumerating

Answer

Call 'aws s3 rm' against a test bucket to verify delete-level access