One over-privileged cloud role stood between an attacker and the whole environment.
A cloud configuration and exploitation assessment that turned a single leaked key into a lesson in least privilege, safely.
THE CHALLENGE
A healthcare SaaS company handling sensitive patient data had migrated fast to AWS and worried their cloud IAM had grown organically, with too many roles, too many permissions, no one certain what a single compromised credential could reach. With HIPAA obligations, they needed to know their blast radius before an attacker mapped it.
THE ENGAGEMENT
Cybros performed a cloud penetration test of their AWS environment plus an internal network assessment. Starting from the position of a low-privilege compromised credential (assumed-breach), we mapped the IAM privilege-escalation paths and lateral movement available to an attacker.
WHAT WE FOUND
The standout: a chain of three benign-looking IAM misconfigurations let a low-privilege role escalate to an administrative one, meaning a single leaked developer key could have owned the environment, patient data included.
Over-privileged role reachable via privilege-escalation chain
Path to full account compromise from one key
Public storage bucket exposing internal data
Data leakage
Secrets stored in plaintext environment config
Credential harvesting
Flat internal network, weak segmentation
Unrestricted lateral movement
THE OUTCOME
Cybros delivered a prioritized remediation roadmap. The client tightened IAM to least-privilege, locked the storage bucket, moved secrets into a managed secrets store, and introduced network segmentation. Retest confirmed the escalation chain was broken and the exposures closed. The engagement became evidence for their HIPAA security posture.
“They showed us our cloud the way an attacker sees it, and gave us a clear path to fix it.”
CISO, Healthcare SaaS
READY WHEN YOU ARE
Test your healthcare saas systems the same way.
Book a free 30-minute scoping call, or download our sample report first.