Minimum viable Terraform deployment to test AWS EC2 Auto Scaling privilege escalation https://notdodo.medium.com/aws-ec2-auto-scaling-privilege-escalation-d518f8e7f91b

main.tf

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
  }
}

provider "aws" {
  region = "eu-west-1"

  default_tags {
    tags = {
      Stack = "demo"
    }
  }
}


data "aws_caller_identity" "current" {}

resource "aws_iam_role" "datascientist" {
  path = "/demo/"
  name = "demo-DataScientist"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          AWS = data.aws_caller_identity.current.arn
        }
      },
    ]
  })

  inline_policy {
    name = "DenyPrivEscs"

    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect = "Allow"
          Action = [
            "autoscaling:CreateAutoScalingGroup",
            "autoscaling:CreateLaunchConfiguration",
            "iam:PassRole",
          ]
          Resource = "*"
        }
      ]
    })
  }
}

resource "aws_iam_role" "ec2_admin" {
  path = "/demo/"
  name = "demo-EC2Admin"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      },
    ]
  })
}

resource "aws_iam_role_policy_attachment" "attach_admin" {
  role       = aws_iam_role.ec2_admin.name
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

resource "aws_iam_instance_profile" "privesc_instance_role" {
  name = aws_iam_role.ec2_admin.name
  role = aws_iam_role.ec2_admin.name
}