ROOT IN PROD: THE MOST IMPORTANT SECURITY ANALYSIS YOU WILL NEVER DO ON YOUR AWS ACCOUNTS

Summary from the TLDR InfoSec newsletter

This blog post explains how to identify all principals with root-level access in AWS production environments, which organizations rarely audit comprehensively. It provides code snippets to discover AWS accounts, map IAM roles/users with administrative privileges, analyze SSO permissions, and visualize trust relationships that allow privilege escalation through role assumption chains. The analysis reveals that production access often extends beyond intended administrators to include CI/CD pipelines, forgotten legacy roles, and external accounts through overly permissive trust policies, creating massive attack surfaces that most organizations don't realize exist.