AWSHound An Open-Source AWS OpenGraph Collector

src/pentesting-cloud/aws-security/README.md

@@ -304,6 +304,48 @@ pmapper --profile dev orgs create
 pmapper --profile dev orgs display
 ```
 
+- [**AWSHound**](https://github.com/AWSHound/AWSHound): A read-only collector and offline authorization evaluator that emits a BloodHound OpenGraph for one AWS account or an Organization. Unlike a graph built from policy attachment or trust alone, capability edges are emitted after combining identity and group policies with permissions boundaries, SCPs/RCPs, explicit denies, relevant resource policies, and request conditions.<sup>[[50]](#references)[[51]](#references)</sup>
+
+<details>
+<summary>Build and collection examples</summary>
+
+```bash
+# From an AWSHound source checkout
+
+go build -o awshound ./cmd/awshound
+./awshound all --profile dev -o graph.json
+
+# Or run the published container
+
+docker run --rm -v "$PWD:/work" -w /work \
+  -v "$HOME/.aws:/root/.aws:ro" \
+  ghcr.io/awshound/awshound:latest \
+  all --profile dev -o /work/graph.json
+
+# Several profiles, selected Regions, or an Organization-wide collection
+./awshound all --profile dev,staging --regions us-east-1,us-west-2 -o graph.json
+./awshound all --profile management \
+  --org-role OrganizationAccountAccessRole -o graph.json
+
+# Re-process an existing raw collection without making AWS API calls
+./awshound all --input-dir raw/ -o graph.json
+```
+
+</details>
+
+The pipeline can also be stopped at `collect`, `process`, and `emit` to inspect raw JSON and the built graph before ingestion. Live collection uses the normal AWS credential chain; `--aws-config` can select profiles marked `bloodhound_collect = true`. During an Organization run, a child account whose collection role cannot be assumed is skipped rather than aborting successful accounts.<sup>[[50]](#references)[[51]](#references)</sup>
+
+Interpret the graph as **candidate attack paths**, not automatic proof of exploitation. AWSHound preserves conditions such as external IDs, principal/request/resource tags, source IP, MFA, `kms:ViaService`, and encryption context on edges. Its attacker-favorable static analysis keeps conditional allows it cannot disprove and drops conditional denies it cannot confirm, so every unresolved condition must be validated in the real request context.<sup>[[51]](#references)</sup>
+
+Useful graph semantics include:<sup>[[51]](#references)</sup>
+
+- `AWS_CanAssumeRole` is traversable only after caller-side `sts:AssumeRole` and the role trust policy both authorize the hop; `AWS_Trusts` alone is informational. Compare the [cross-account authorization model](aws-cross-account-attacks/) and [IAM escalation techniques](aws-privilege-escalation/aws-iam-privesc/).
+- `AWS_CanUpdateLambdaCode` followed by `AWS_RunsAs` models [Lambda code replacement](aws-privilege-escalation/aws-lambda-privesc/) and execution as the function role. The same runtime-role pivot is modeled for [SSM command/session access](aws-privilege-escalation/aws-ssm-privesc/) to [EC2](aws-privilege-escalation/aws-ec2-privesc/) and the instance-profile role.
+- Composite edges such as `AWS_CanCreateAndAssumeAdminRole` collapse a complete permission combination into an account-takeover hop while retaining the authorizing methods and policies as edge properties. AWSHound also maps execution-role paths through [CloudFormation](aws-privilege-escalation/aws-cloudformation-privesc/) and identity pivots through [EKS](aws-post-exploitation/aws-eks-post-exploitation/).
+- Data-access edges such as SSM parameter reads and [KMS decryption](aws-privilege-escalation/aws-kms-privesc/) are deliberately non-traversable: reading or decrypting data does not by itself prove acquisition of another identity.
+
+Enable every collector required by the path being tested: omitting Organizations removes SCP/RCP restrictions from evaluation, and S3 is disabled by default because of collection cost. Current blind spots include IAM Identity Center assignments, Kubernetes RBAC/workloads, EC2 network paths, secret values, Lambda code/environment values, CloudFormation templates/parameters, cross-account KMS evaluation, and complete S3 object inventory; absence of a path is therefore not proof that none exists.<sup>[[51]](#references)</sup>
+
 - [**cloudsplaining**](https://github.com/salesforce/cloudsplaining): An AWS IAM assessment tool that identifies least-privilege violations and generates a risk-prioritized report. It can scan account policies or supplied policy files and highlights permissions relevant to privilege escalation, data exposure, and infrastructure modification.<sup>[[37]](#references)</sup>
 
 ```bash
@@ -450,5 +492,7 @@ aws ...
 - [47] [Cloud Custodian repository](https://github.com/cloud-custodian/cloud-custodian)
 - [48] [PacBot repository](https://github.com/tmobile/pacbot)
 - [49] [StreamAlert repository](https://github.com/airbnb/streamalert)
+- [50] [AWSHound repository and usage](https://github.com/AWSHound/AWSHound)
+- [51] [AWSHound: An Open-Source AWS OpenGraph Collector](https://specterops.io/blog/2026/08/19/awshound-opensource-aws-opengraph-collector/)
 
 {{#include ../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-codeartifact-enum.md

@@ -66,3 +66,4 @@ Publishing the package did **not** start a build automatically. Exploitation req
 - [2] [GetPackageVersionAsset API](https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetPackageVersionAsset.html)
 - [3] [Packages overview, publishing permissions, and asset overwrite rules](https://docs.aws.amazon.com/codeartifact/latest/ug/packages-overview.html)
 - [4] [AWS CodeArtifact permissions reference](https://docs.aws.amazon.com/codeartifact/latest/ug/auth-and-access-control-permissions-reference.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-greengrass-enum.md

@@ -28,3 +28,4 @@ The same API did **not** retrieve an ordinary private component backed by an arb
 
 - [1] [Develop AWS IoT Greengrass components](https://docs.aws.amazon.com/greengrass/v2/developerguide/develop-greengrass-components.html)
 - [2] [GetComponentVersionArtifact API](https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetComponentVersionArtifact.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-iot-core-enum.md

@@ -295,3 +295,4 @@ If listing is denied, tunnel IDs occur in open/rotate responses, device notifica
 - [16] [IoT SQL FROM clause](https://docs.aws.amazon.com/iot/latest/developerguide/iot-sql-from.html)
 - [17] [AWS IoT rule actions](https://docs.aws.amazon.com/iot/latest/developerguide/iot-rule-actions.html)
 - [18] [Publish API - AWS IoT](https://docs.aws.amazon.com/iot/latest/apireference/API_iotdata_Publish.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-ivs-chat-enum.md

@@ -78,3 +78,4 @@ The application-specific user ID and attributes are caller-controlled inputs to
 - [2] [Amazon IVS Chat Messaging SDK for JavaScript](https://docs.aws.amazon.com/ivs/latest/ChatUserGuide/chat-sdk-js.html)
 - [3] [Getting started with Amazon IVS Chat](https://docs.aws.amazon.com/ivs/latest/ChatUserGuide/getting-started-chat.html)
 - [4] [Actions, resources, and condition keys for Amazon IVS Chat](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninteractivevideoservicechat.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-streams-enum.md

@@ -44,3 +44,4 @@ Resource policies, IAM policies, KMS configuration, retention, iterator expiry,
 - [1] [GetShardIterator API](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetShardIterator.html)
 - [2] [GetRecords API](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetRecords.html)
 - [3] [Kinesis Data Streams terminology and concepts](https://docs.aws.amazon.com/streams/latest/dev/key-concepts.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-mediapackage-v2-enum.md

@@ -1,5 +1,7 @@
 # AWS - MediaPackage v2 Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## MediaPackage v2 basics
 
 AWS Elemental MediaPackage v2 receives live media through channels and serves packaged content through origin endpoints. Both resources support IAM-style resource policies. Consequently, a principal that can replace one of those policies may grant an external principal access without receiving any MediaPackage list or read permission itself.
@@ -114,3 +116,4 @@ aws mediapackagev2 delete-channel-group \
 - [Channel policy examples](https://docs.aws.amazon.com/mediapackage/latest/userguide/security_iam_resource-based-policy-examples.html)
 - [PutChannelPolicy API](https://docs.aws.amazon.com/mediapackage/latest/APIReference/API_v2_PutChannelPolicy.html)
 - [PutOriginEndpointPolicy API](https://docs.aws.amazon.com/mediapackage/latest/APIReference/API_v2_PutOriginEndpointPolicy.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-transcribe-enum.md

@@ -34,3 +34,4 @@ If `ListTranscriptionJobs` is denied, job names frequently appear without additi
 
 - [1] [How Amazon Transcribe works with input and output data](https://docs.aws.amazon.com/transcribe/latest/dg/how-input.html)
 - [2] [GetTranscriptionJob API](https://docs.aws.amazon.com/transcribe/latest/APIReference/API_GetTranscriptionJob.html)
+{{#include ../../../banners/hacktricks-training.md}}