AWS sts:AssumeRole Chain
Hop across trust relationships (cross-account, cross-service) via STS — common when role trust policies are over-broad.
§ Where this technique fits
C-AWS-ASSUMEROLE-CHAIN is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 3 approved dossiers in the registry, typically at step 4.7 on average.
§ Dossiers chaining this technique
- step 4 / 6
GitHub OIDC trust over-broad → AWS admin
An IAM role trusts GitHub Actions OIDC with a wildcard 'repo:*' subject. Any attacker GitHub repo can assume the role and run with its privileges.
- step 4 / 9
SSRF → IMDS → AssumeRole chain → Org admin
A web SSRF leaks the EC2 instance role; iam:PassRole + sts:AssumeRole hops across two member accounts land you with AdministratorAccess in the organisation's management account.
- step 6 / 7
pull_request_target injection → secrets → cloud takeover
A GitHub Actions workflow runs on pull_request_target and checks out the PR's head SHA. The attacker's PR injects code that runs with the base repo's secrets, including a cloud deploy role.
§ What commonly comes next
- 01AWS IAM Backdoor User / Access Keyseen 1×C-AWS-IAM-BACKDOOR · Persistence
- 02AWS iam:AttachUserPolicy → AdminAccessseen 1×C-AWS-IAM-ADDUSER-POLICY · Privilege Escalation
- 03AWS iam:PassRole Chainseen 1×C-AWS-IAM-PASSROLE · Privilege Escalation
- 04Secrets Manager / Key Vault Dumpseen 1×C-SECRETS-MANAGER-DUMP · Credential Access