Privilege Escalation in AWS SageMaker Studio due to Overly Permissive Default IAM Roles
Overview
A widespread security misconfiguration issue was highlighted by cloud security firm Orca Security, affecting AWS SageMaker Studio environments. The issue stems from the use of overly permissive default IAM execution roles, particularly roles created using the `AmazonSageMakerFullAccess` managed policy. This policy grants extensive permissions, including `s3:*` on all S3 buckets (`s3:::*`) and broad EC2 management capabilities. In a typical enterprise setup, a data scientist using a SageMaker Studio notebook should be restricted to specific project-related S3 buckets. However, with the default role, a compromised notebook instance (e.g., via a vulnerable dependency) or a malicious insider could leverage these permissions to access and exfiltrate sensitive data from any S3 bucket in the AWS account. Furthermore, the EC2 permissions could be abused to launch unauthorized instances for activities like cryptocurrency mining or to create network backdoors into the VPC. This is not a software vulnerability in SageMaker itself but a critical configuration weakness that violates the principle of least privilege, allowing for easy lateral movement and privilege escalation from the ML environment to the wider cloud account.
Affected Systems
Testing Guide
1. Review the IAM execution roles attached to your SageMaker domains and user profiles. 2. Check the attached policies for wildcard permissions, especially `s3:*` on resource `*` or broad EC2 permissions. 3. From a SageMaker Studio notebook, attempt to list all S3 buckets in the account using the AWS CLI or boto3 (`aws s3 ls`). If you can see buckets outside the scope of your project, the role is overly permissive.
Mitigation Steps
1. Avoid using the `AmazonSageMakerFullAccess` policy for SageMaker execution roles. Instead, create custom IAM policies that grant access only to the specific S3 buckets and AWS resources required for the ML project. 2. Use IAM's `Condition` keys to further restrict access, such as limiting S3 access to specific prefixes or allowing EC2 instance creation only with specific tags. 3. Implement AWS Service Control Policies (SCPs) at the organization level to set guardrails that prevent even administrators from creating overly permissive roles for SageMaker. 4. Regularly audit IAM roles using tools like AWS IAM Access Analyzer to identify and remediate excessive permissions.
Patch Details
This is a configuration issue. Mitigation requires manual user intervention to create and apply least-privilege IAM policies.