Cloud lateral movement

Description

How: an over-broad trust relationship ('anyone can assume this role'), a service account that can escalate, cross-account roles set up loosely for convenience. The attacker maps who-can-become-whom and walks the chain to the rights they want.

The consequence is that a single foothold in a low-value identity becomes admin in a different account. There's no wall to breach — the permission graph itself allows the movement, which is why it's quiet.

Examples

• A small business sets up a role 'anyone can assume'; the attacker takes it from a low-value account, then the next one through it, up to admin.
• A bank links accounts across environments for convenience; the attacker chains role assumptions from the test environment into production.
• A distributor has a service account allowed to become admin 'just in case'; that 'just in case' is exactly the attacker's path.

Notes

• Here you don't breach the network, you walk through permissions — the movement is quiet because the system considers it allowed.
• The 'who can become whom' map matters more than the network map; the attacker draws it before you do.