CloudPEASS - Cloud Privilege Escalation Scanner

AWS

Azure

GCP

ℹ️ AWS CloudPEASS

Enumerate your AWS permissions and detect privilege escalation paths. This tool will analyze IAM policies, simulate permissions, and suggest attack vectors.

📖 View CloudPEASS documentation on GitHub

AWS Access Key ID Your AWS access key ID for authentication

AWS Secret Access Key Your AWS secret access key

AWS Session Token (Optional) For temporary credentials

Region AWS region for API calls

AWS Services to Bruteforce Comma-separated list of AWS services (max 15). Required to avoid long execution times.

Options Skip IAM policy enumeration Skip permissions simulation Skip brute-force enumeration

I confirm that I have authorization to perform security testing on the provided cloud account and have read and agree to the Terms of Service. I understand that unauthorized testing may be illegal and I am solely responsible for ensuring proper authorization.

ℹ️ Azure CloudPEASS

Enumerate your Azure and Entra ID permissions. This tool analyzes ARM and Graph API permissions, checks M365 services, and suggests privilege escalation paths.

📖 View CloudPEASS documentation on GitHub

ARM Token (Optional) Azure Resource Manager authentication token

Graph Token (Optional) Microsoft Graph authentication token

FOCI Refresh Token (Optional) Family of Client IDs refresh token (generates ARM and Graph tokens)

Tenant ID (Optional) Required when using FOCI refresh token

Username (Optional) Username for authentication (service principal or user without MFA)

Password (Optional) Password or client secret for authentication

Options Skip Entra ID enumeration (focus only on Azure subscriptions) Don't enumerate M365 services (SharePoint, OneDrive, Teams, etc.)

ℹ️ GCP CloudPEASS

Enumerate your GCP permissions across projects, folders, and organizations. This tool analyzes IAM policies, tests permissions, and identifies privilege escalation paths.

📖 View CloudPEASS documentation on GitHub

Access Token GCP OAuth2 access token (get via: gcloud auth print-access-token). Use either token OR service account key.

Service Account Key (JSON) Service account JSON key file content. Use either token OR service account key.

Project IDs (Optional) Comma-separated list of GCP project IDs to scan

Folder IDs (Optional) Comma-separated list of folder numbers

Organization IDs (Optional) Comma-separated list of organization IDs

Options Skip brute-force permission enumeration Don't retrieve IAM policies for resources

📊 Scan Results

Running CloudPEASS scan... This may take several minutes.

Queueing job…

🔒 Login required

ℹ️ AWS CloudPEASS

ℹ️ Azure CloudPEASS

ℹ️ GCP CloudPEASS

📊 Scan Results