Razeen AcademyRazeen — Cloud Security
All labs العربية Log in
LAB-02 · Free

The Excess Permission

A new intern was given "basic" permissions, and three minutes later she was Admin over the whole account. Your job: find out how.

the briefwaha finance

Waha Finance is back. Last week a new intern joined: intern-sara. Her job is reviewing IAM policies. The admin gave her permissions he called "almost read-only".

A few days later, the security team noticed her account doing things it shouldn't be able to. You have her permissions file and her activity log. Work out what happened.

evidence2 files
waha-intern-policy.jsonv1 · original
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InternDailyTasks",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject",
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:ListPolicyVersions",
        "iam:CreatePolicyVersion"
      ],
      "Resource": "*"
    }
  ]
}
cloudtrail-intern-sara.logsynthetic dataset
// 2026-10-28  09:12:04Z
{ "eventName": "GetPolicy",
  "userIdentity": "intern-sara",
  "sourceIPAddress": "203.0.113.24",
  "policyArn": "arn:aws:iam::111122223333:policy/waha-intern-policy" }

// 2026-10-28  09:13:41Z
{ "eventName": "ListPolicyVersions",
  "userIdentity": "intern-sara",
  "result": ["v1 (default)"] }

// 2026-10-28  09:15:09Z   CLI: aws iam create-policy-version
{ "eventName": "CreatePolicyVersion",
  "userIdentity": "intern-sara",
  "requestParameters": {
    "policyArn": "arn:aws:iam::111122223333:policy/waha-intern-policy",
    "setAsDefault": true,
    "policyDocument": {
      "Statement": [{
        "Sid": "RAZEENEscalatedViaCreatePolicyVersion",
        "Effect": "Allow",
        "Action": "*",
        "Resource": "*"
      }]
    }
  },
  "responseElements": { "versionId": "v2", "isDefaultVersion": true } }

// 2026-10-28  09:16:30Z
{ "eventName": "ListUsers",
  "userIdentity": "intern-sara",
  "errorCode": null }   // succeeded… two minutes earlier this was denied

Realistic files with a synthetic dataset. Read them the way a security analyst would.

investigation06 steps
01

Which of the intern's permissions is the dangerous one?

Hint

Look for the only permission that writes and changes things, not just reads.

iam:CreatePolicyVersion. It lets her write a new version of her own policy — in other words, grant herself anything.

02

Which CLI command did the intern use to escalate?

Hint

Look at the log at 09:15 — there's a comment with the command.

aws iam create-policy-version with --set-as-default.

03

After the change, the policy contains "Action": "*" and "Resource": "*". What does this mean?

Hint

In IAM, the asterisk (*) means "everything".

She became full Admin. The first thing she ran was ListUsers — and it worked.

04

What's the flag?

Hint

Attackers sometimes leave a signature in the policy they write.

Another hint (if you're stuck)

Every Statement has a Sid (an identifier). Check the Sid in the new policy.

Correct flag.

05

What's the best fix for the intern's permissions?

Hint

Monitoring catches the problem after it happens. What stops it in the first place?

Remove the dangerous permission and scope the resources. Monitoring matters, but it doesn't prevent.

06

Which security principle was broken here?

Least Privilege — a cornerstone of the identity and access management controls in NCA CCC.

Case closed

You found the permission that opened the door, traced the attacker through the log, and learned how to shut it. That's an IAM auditor's daily work.

Continue to LAB-03: The Unreviewed Code

Waha Finance is a fictional company for educational purposes; any resemblance to a real organization is unintended. All data in this lab is a synthetic dataset. Only use these skills on systems you're authorized to test.