# Execution: AWS IAM Privilege Escalation & Data Exfiltration Simulation
$ stratus detonate aws.privilege-escalation.iam-passrole-ec2-instance
[+] Extracted temporary STS token from IMDSv2 metadata session
[+] Role: arn:aws:iam::123456789012:role/EdgeWorkerNode

$ aws sts assume-role \
    --role-arn arn:aws:iam::987654321098:role/CrossAccountDataPlaneAccess \
    --role-session-name AdversaryTestSession \
    --external-id ProductionTelemetrySync

# Result: Privileged access gained to internal audit logs & customer store
# Penetration Test Verdict: CRITICAL FINDING - Unrestricted STS Trust Boundary

import boto3
import datetime

iam = boto3.client('iam')
ec2 = boto3.client('ec2')

def emergency_quarantine_session(role_name, compromised_instance_id):
    revocation_time = datetime.datetime.utcnow().isoformat() + "Z"
    policy_document = f'''{{
        "Version": "2012-10-17",
        "Statement": [{{
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {{"DateLessThan": {{"aws:TokenIssueTime": "{revocation_time}"}}}}
        }}]
    }}'''
    iam.put_role_policy(
        RoleName=role_name,
        PolicyName="EmergencyRevokeActiveSessions",
        PolicyDocument=policy_document
    )
    ec2.modify_instance_attribute(
        InstanceId=compromised_instance_id,
        Groups=['sg-isolation-zero-egress']
    )
    print(f"[CONTAINED] Tokens revoked for {role_name}. Instance {compromised_instance_id} isolated.")

data "aws_iam_policy_document" "hardened_assume_role" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::123456789012:root"]
    }
    condition {
      test     = "IpAddress"
      variable = "aws:SourceIp"
      values   = ["196.25.1.0/24", "10.100.0.0/16"]
    }
    condition {
      test     = "Bool"
      variable = "aws:MultiFactorAuthPresent"
      values   = ["true"]
    }
  }
}