# Cross-Account and Role Assumption Attacks

> Master cross-account IAM attacks. Learn to exploit overly permissive trust policies, abuse STS AssumeRole, and pivot across cloud boundaries.

Canonical: https://codelivly.com/rooms/cross-account-and-role-assumption-attacks
Last updated: 2026-09-25

| | |
|---|---|
| Level | Advanced |
| Category | Cloud Security |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This advanced module explores the mechanics of cross-account and role assumption attacks in cloud environments. You will learn how adversaries exploit overly permissive IAM trust policies, missing External IDs, and the "confused deputy" problem to pivot from a compromised low-privilege account to highly privileged production environments. The curriculum covers abusing sts:AssumeRole, mapping cross-account trust relationships, and implementing robust defensive guardrails like strict condition keys and organization-wide SCPs to secure multi-account architectures.

## Lessons

1. What Is Cross-Account Trust Abuse and Why Does It Matter (30 min)
2. Role Assumption Chains and Trust Policy Weaknesses (30 min)
3. Pivoting Across Accounts with Pacu (30 min)
4. Guided Lab: Chaining Role Assumptions to Reach a Sensitive Account (30 min)

## Related

- [Learning path: Cloud Attack Techniques and Offensive Security](https://codelivly.com/learning-paths/cloud-attack-techniques-and-offensive-security)
- [All rooms](https://codelivly.com/rooms)