pathbreak-audit: find the abusable IAM permissions in your AWS account

By the Pathbreak team · October 21, 2026 · 4 min read

The AWS Privilege Escalation Map is a reference: every AWS permission an attacker can use to move toward admin, data, or persistence, and the change that breaks each path. The map tells you what could go wrong in AWS in general. pathbreak-audit tells you which of those permissions are sitting in your own account right now.

What it does

pathbreak-audit reads the policies attached to each role and user, managed, inline, and the policies users inherit from groups, works out the actions each principal is allowed, and matches that against the catalogue of dangerous permissions and combinations. For every principal it prints what it holds and the least-privilege change that removes it, with a link to the full write-up on the map.

Findings come in two kinds. A directly abusable permission is a single action that lets a principal escalate, persist, or tamper with logging, for example iam:CreateAccessKey on another user. A toxic combination is a set of permissions that are only dangerous together, like iam:PassRole with lambda:CreateFunction, which a one-policy-at-a-time review tends to miss.

Why the default view is short

A tool that flags every broad read and every permission recreates the alert fatigue it is meant to solve. So the default view is the permissions that are abusable no matter the target: escalation, persistence, logging tampering, and destruction. Broad data and secret reads, Lambda invoke, role assumption, and session access only matter when the resource they reach is privileged, which a single-account static check cannot know, so they are held back unless you ask for them with --include-access. Full administrators and AWS default roles are set aside by default too, so the list stays short and worth reading.

Try it

You can see the output with no AWS account at all:

pip install pathbreak-audit
pathbreak-audit --demo

To run it against your own account, use any credentials with read access to IAM. The AWS managed policies SecurityAudit or ViewOnlyAccess both cover it:

pathbreak-audit --profile my-profile

The full options, example output, and source are on GitHub.

What it does not do

pathbreak-audit is a point-in-time check of one account. It reads what policies allow, so a narrowly scoped grant can still show up, and it tells you a permission could be abused, not that it chains all the way to something sensitive. It does not traverse the graph across accounts, it does not validate that a path resolves against your real authorization, and it does not watch for drift. We draw that line on purpose.

pathbreak-audit shows the permissions that could be abused, principal by principal. Pathbreak shows which of those chain into a validated path that reaches your sensitive data, ranks them by blast radius across every account, and hands back the single change that breaks the most paths, continuously. If the tool is useful, that is the next step.

Frequently asked questions