  Identity and Access Management (IAM) is an access control service in cloud
platforms. To securely manage cloud resources, customers are required to
configure IAM to specify the access control rules for their cloud
organizations. However, incorrectly configuring IAM may be exploited to cause a
security attack such as privilege escalation (PE), which can cause severe
economic loss. To detect such PEs due to IAM misconfigurations, third-party
cloud security services are commonly used. The state-of-the-art services apply
whitebox penetration testing techniques, which require the access to complete
IAM configurations. However, the configurations can contain sensitive
information. To prevent the disclosure of such information, the customers have
to put lots of manual efforts for the anonymization.
  In this paper, we propose a precise greybox penetration testing approach
called TAC for third-party services to detect IAM PEs. To mitigate the dual
challenges of labor-intensive anonymizations and potentially sensitive
information disclosures, TAC interacts with customers by selectively querying
only the essential information needed. Our key insight is that only a small
fraction of information in the IAM configuration is relevant to the IAM PE
detection. We first propose IAM modeling, enabling TAC to detect a broad class
of IAM PEs based on the partial information collected from queries. To improve
the efficiency and applicability of TAC, we aim to minimize the interactions
with customers by applying Reinforcement Learning (RL) with Graph Neural
Networks (GNNs), allowing TAC to learn to make as few queries as possible.
Experimental results on both our synthesized task set and the only publicly
available task set IAM Vulnerable show that, in comparison to state-of-the-art
whitebox approaches, TAC detects IAM PEs with competitively low false negative
rates, employing a limited number of queries.
