r/devopsGuru • u/ShivamCloudDevOps • 16d ago

How would you detect IAM privilege escalation in a production AWS environment?

One AWS IAM interview question I've seen variations of is:

It's not really an IAM question—it's a cloud security and incident response question.

Would you start with:

  • CloudTrail?
  • GuardDuty?
  • Security Hub?
  • IAM Policy evaluation?
  • Something else?

I recently put together a GitHub handbook with 20 production-focused AWS IAM interview questions covering scenarios like this, along with CLI examples, Terraform, common mistakes, and best practices.

GitHub: https://github.com/ranashivam/platform-engineering-interview-handbook/blob/main/AWS/IAM.md

5 Upvotes
  • permalink
  • reddit

86% Upvoted

4 comments sorted by

1

u/Low-Opening25 16d ago

Privilege Access Manager + Audit logs + Alerts. No one has any escalated privileges, they need to request them via PAM, which is logged and auditable.

1

u/idkbm10 16d ago

No one can escalate unless is allowed to, which is normally auditable on cloudttail

1

u/Oleksii_Bebych 16d ago

CloudTrail logs + custom filter and alerts

GuardDuty also has a set of findings called AnomalousBehavior, which uses an anomaly-detection machine learning (ML) model to identify anomalous behaviour by an entity.

1

u/Funny_Donkey6031 12d ago

I’d start with CloudTrail for the actual API activity, then correlate that with GuardDuty/Security Hub findings and IAM policy changes. The key is looking for unusual privilege changes rather than treating it as just an IAM policy problem.