- Published on
The challenge provides Access Keys that allows for IAM enumeration that leads to a policy that has limited permissions for S3 and IAM, eventually allowing the user to assume a role with the necessary KMS:Decrypt permission to download the flag from the S3 bucket