Pacu AWS

pacu > run iam__enum_users_roles_policies_groups

Enumerate users, roles, policies, and IAM groups of a compromised AWS account using the Pacu framework.

Run it when you have AWS credentials (stolen Access Key or role assumed after SSRF in the metadata service) and want to map the scope: which users exist, which roles can be assumed, which policies are present. Pacu automates the enumeration and stores results in its local database for subsequent modules.

IAM enumeration generates CloudTrail (chained ListUsers, ListRoles, ListPolicies) and blue teams with IAM recon rules will spot it quickly. If stealth is the goal, make targeted calls with aws cli instead of sweeping the full module.