Blue LanternSecurity
← Back to all posts

· Blue Lantern Team · Reviewed September 15, 2026 · Practical Applications

Hunting Down iam:PassRole in AWS

iam:PassRole is one of the quieter privilege escalation primitives in AWS. It lets a principal hand a role to a service that can then do things the original principal couldn't. If a user with iam:PassRole plus a service action like ec2:RunInstances is compromised, the blast radius is much bigger than their direct permissions suggest.

You want to know who has it, and whether they should.

This check covers AWS permissions through the on-prem toolkit. It is separate from the daily directory scan for MFA registration and dormant accounts described in what IAM means in cybersecurity.

Prerequisites

  • The Blue Lantern on-prem toolkit installed locally.
  • Credits allocated to the toolkit (or auto-refresh enabled).
  • AWS credentials with read access to IAM. The toolkit reads an .env file containing AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. We recommend a sealed secrets file so credentials stay encrypted at rest.

Running the check

Through the CLI:

bluelantern run aws-iam find-principals-allowed-action \
  --credential_file /data/secrets/aws.env \
  --action iam:PassRole

Or through the local UI: bluelantern ui and run the same check from the browser.

If you have a sealed secrets file configured, you can drop the --credential_file flag.

What you get back

A list of every principal (users and roles) with iam:PassRole. Each entry includes:

  • Principal type (User or Role).
  • Principal name.
  • The action being audited.

From there it's a desk audit: cross-reference the list with what each principal is supposed to do. Anyone with iam:PassRole who doesn't need it is a privilege escalation path waiting to be exploited.

The same command shape works for any IAM action you want to audit. Swap iam:PassRole for whatever you're hunting.

See our blog posts on other technical topics!

See how we compare to other tools!