2026 Critical Cloud Control Plane Detection: Privilege Escalation via iam:PassRole Chained with Compute or Function Deployment
Detects potential privilege escalation where an identity with iam:PassRole permissions deploys or updates compute resources (CloudFormation, EC2, or Lambda) to assume a more privileged IAM role than the user currently holds.
Sigma
