Cloud IAM Privilege Escalation

A sophisticated human operator gained initial access through a compromised developer workstation and is attempting privilege escalation within the AWS environment. The attacker has demonstrated knowledge of AWS IAM internals, attempting to chain iam:PassRole with lambda:CreateFunction for privilege escalation. The CIE has deployed shadow IAM policies that appear to grant escalated privileges but actually route all actions through a monitored sandbox. The attacker has executed 4 actions in the sandboxed environment, revealing their exfiltration targets.