English
Español
Français
Deutsch
日本語
한국어
العربيةFind and break the attack paths in AWS
Pathbreak finds the privilege escalation paths in your AWS accounts, validates each one read-only, and ranks the fixes by how many paths they break, with the exact command to run for each.
We connect read-only to one account, show you the paths an attacker could chain, and hand you the single change that breaks each one.
Built by offensive cloud security practitioners and the team behind redamon, 3,000+ GitHub stars.
How Pathbreak proves a path
A chain drawn on a graph is a candidate. AWS evaluates several policies on every call, and any one of them can turn an allow into a deny. Pathbreak resolves all of them for each step, read-only, before it reports a path. These are the six checks for the chain above.
- Identity policyDoes
ci-deployallowiam:PassRoleondata-pipeline? Yes, throughrole/data-*. - Condition keysIs the pass limited by
iam:PassedToService? No condition is set, so any service can receive the role. - Trust policyDoes
data-pipelinetrustlambda.amazonaws.com? Yes. - Service control policiesDoes an SCP deny
lambda:CreateFunctionoriam:PassRolefor this account? No. - Permission boundaryDoes a boundary on
ci-deployremove either action? The role has no boundary. - ImpactWhat does
data-pipelinereach? AdministratorAccess in this account, and two more accounts through cross-account trust.
Result
Every check passes, so the path is proven. Nothing was created or invoked. Pathbreak resolved the same policies AWS would, in the same order.
The fix
Scope the iam:PassRole grant to the one role CI deploys with. Check 1 now fails and the path no longer resolves.
Map
Connect one account or a whole AWS Organization. Pathbreak builds a graph of every principal, role, trust relationship and resource.
Reason
The agent chains control-plane moves across the graph the way an attacker would, into multi-hop candidate paths.
Validate
Each candidate goes through the checks above, read-only, against the real authorization.
Break
Fixes are ranked by how many paths each one breaks, with the exact change, usually one command.
Confirm
Apply the fix and re-check. The path no longer resolves, and the result is kept from scan to scan.
Fixes ranked by how many paths they break
Every fix is scored by how many paths it breaks and how many sensitive resources it protects, so the top of the list is the change to make first.
Exact cut or wide cut
A scoped Deny statement on one principal, or a tightened trust policy on the target. You see what each option breaks before you change anything.
One command each
Most fixes are a single AWS CLI command, ready to copy.
Confirm the path is gone
Mark a fix applied, re-check the path and watch the count fall. Send the rest to Jira and track remediation over time.
What Pathbreak finds
The dangerous moves in AWS are in identity, trust and configuration. These are the four kinds of path Pathbreak traces and validates.
IAM privilege escalation
From a low-privilege principal to administrator through permission misconfigurations, policy abuse and role chaining.
Cross-account trust abuse
Trust relationships that let an attacker step from one account into another, including over-permissive role assumptions between environments.
Exposed credentials and public entry points
Long-lived keys left in EC2 user data, Lambda environment variables and CloudFormation outputs, and public Lambda function URLs that hand an attacker a role.
Resource and data exposure
The step that turns access into impact: the data, secrets and infrastructure a principal can reach once an identity chain has been walked end to end.
AWS is available today. Azure and Entra ID come next, then Google Cloud. Every permission behind these paths, with the CloudTrail events that show it and the change that breaks it, is in the AWS Privilege Escalation Map.
Check your own roles with pathbreak-audit
pathbreak-audit is our free, open source command line tool for defenders. It reads the IAM roles and users in one AWS account, read-only, and lists the ones that hold abusable permissions from the map, with one way to break each path. Install it with pip install pathbreak-audit or read the source on GitHub.
$ pathbreak-audit --demo PATHBREAK AWS IAM exposure, for defenders v0.1.0 https://pathbreak.io Account: 123456789012 (example data) Scanned 7 principals. 4 hold abusable permissions (6 direct, 3 toxic combinations). ------------------------------------------------------------------------ ROLE iam-helpdesk arn:aws:iam::123456789012:role/iam-helpdesk * Directly abusable | Attach admin policy to user needs: iam:AttachUserPolicy grants: Can attach the AdministratorAccess managed policy to this user to break it: Remove iam:AttachUserPolicy from the principal. privilege-escalation details: https://pathbreak.io/aws-privilege-escalation-map/iam-attachuserpolicy ------------------------------------------------------------------------ ROLE ci-lambda-builder arn:aws:iam::123456789012:role/ci-lambda-builder * Toxic combination of 2 | Pass role to Lambda needs: iam:PassRole + lambda:CreateFunction grants: Can pass this role to a new Lambda function and run code as it to break it: Remove iam:PassRole for this role or scope it with iam:PassedToService. privilege-escalation details: https://pathbreak.io/aws-privilege-escalation-map/lambda-passrole-create ------------------------------------------------------------------------ This is a point-in-time list of permissions that could be abused. To see which of these reach your sensitive data, the blast radius across accounts, and the one change that breaks the most paths, run Pathbreak: https://pathbreak.io
pathbreak-audit --demo on its bundled example account, trimmed to two of the four roles it flags.The checks a scanner runs, in the same product
Pathbreak also runs hundreds of exposure checks across your AWS accounts and scores every scan against 44 compliance frameworks, including SOC 2, ISO 27001, PCI DSS 4.0, HIPAA, NIST 800-53 and CSF, the CIS Benchmarks and AWS Foundational Security Best Practices.
Findings go to Jira, AWS Security Hub and S3, or through the API. You can replace a standalone scanner with it or run it next to the one you have.
Pricing
Priced by the number of AWS accounts you monitor. Every feature is included at every size.
Subscription
$900 a year for each account from 6 to 25, and $400 for each from 26 to 100. Above 100 accounts we quote.
See pricingFree trial
Trial data is deleted seven days after the trial ends. API access and integrations come with a subscription.
Start a free trialWho builds Pathbreak
We have traced these paths by hand in AWS environments for years. Pathbreak turns that work into a product that runs across your accounts.
Ian Austin
- More than 20 years in technical, security and leadership roles for global enterprises
- Founder and CEO of Pwned Labs, the cloud and AI security training platform with more than 40,000 users
- Former Head of Content and Innovation at Hack The Box, where he led BlackSky, its cloud hacking labs
- Helped design and run scenarios on the Green Team of Locked Shields, the NATO cyber defense exercise
- Active penetration tester and instructor on cloud attack and defense bootcamps
Samuele Giampieri
- Creator of redamon, an open-source agentic red-team framework that automates attacks from reconnaissance to exploitation, with more than 3,000 stars on GitHub
- More than 15 years in software engineering, building multi-agent AI systems, graph databases and machine learning models in production
- Solution architect and development lead on AI and cloud platforms, building on AWS since 2017
- Founded and led an e-commerce company as CEO for ten years
Access and data
Pathbreak maps how privileges could be escalated in your environment, so we are careful with the access you grant and the data it reads.
Read-only access
Least-privilege and read-only. You grant it, scope it to the accounts you choose and revoke it when you want.
Configuration only
Pathbreak reads identity, policy and resource configuration, including the places credentials get exposed. It does not read object storage or database contents.
Nothing executed
Paths are validated by resolving authorization. Nothing runs against your resources.
Your model, your keys
Anthropic, OpenAI, Google Gemini, Amazon Bedrock in your own AWS account, or any OpenAI-compatible endpoint. Keys are stored encrypted, and your data is not used for training.
Isolated and encrypted
Your data stays isolated and encrypted in transit and at rest.
Single sign-on and roles
OpenID Connect today, SAML on request, custom roles, and a support access log that records every staff visit with its reason and time limit.
Questions
What is Pathbreak?
Pathbreak finds the privilege escalation paths in your AWS accounts, validates each one read-only by resolving the real authorization, and ranks the fixes by how many paths they break, with the exact command for each. It also runs the exposure checks and compliance scoring you would expect from a scanner, so it can replace one or run alongside it.
How is Pathbreak different from a vulnerability scanner or CSPM?
Traditional scanners and CSPM tools list thousands of isolated findings. Pathbreak reasons across your whole environment, validates which paths are exploitable by resolving the real authorization, read-only, and reports only the ones that resolve, with the fix that severs each chain.
Does validation mean running exploits in my AWS account?
No. In the AWS control plane the attacker's moves are API calls, and each call is allowed or denied by policy documents. Resolving those documents read-only gives the same decision AWS would, so a path can be proven without creating, invoking or changing anything.
Does Pathbreak use or train on my data?
No. Pathbreak reads your control-plane metadata and resource configuration, such as IAM policies, roles, trust relationships and the settings where credentials are commonly exposed. It does not read your object storage or database contents, and detected secret values are not kept. When a scan finds an exposed AWS access key it keeps only the public key ID so the remediation can name the key; the secret access key is never read or stored. It runs on an LLM you provide, under your own credentials, and does not use your data to train any model.
Which cloud environments does Pathbreak support?
Pathbreak is available for AWS today, with the deepest coverage of AWS control-plane chains such as IAM privilege escalation and cross-account trust abuse. Azure and Microsoft Entra ID come next, with Google Cloud and hybrid on the roadmap.
See the paths in your own account
We connect read-only to one account, walk you through the paths we find, and you keep the results.