Why this topic matters
Control-plane abuse matters because cloud APIs can create or destroy trust without touching a single host shell. Snapshotting disks, attaching policies, granting roles, rotating access keys, creating service accounts or changing bucket policies often delivers more leverage than a classic foothold.
Operator checks
- Map which identities can create, assume, attach, impersonate or modify other identities.
- Track management APIs separately from workload traffic. The control plane is usually the real prize.
- Look for privilege expansion by inheritance: instance profiles, managed identities, service accounts and automation roles.
- Pay attention to metadata access, token minting paths and temporary credential lifetimes.
Reporting lens
Write findings in terms of trust crossed, scope enlarged and business or operational effect reached. That keeps the note useful whether you are validating a lab, an internal research target or a live customer environment.
Curated public references
- AWS STS AssumeRoleRole assumption semantics and temporary credentials.
- Azure Managed IdentitiesManaged identity trust and workload-side token acquisition.
- GCP Service Account ImpersonationService-account token creation and delegation.