Cross-Account sts:AssumeRole
cloud · medium · +45 XP
Target
GET /api/lab/assume-role-101/role (target role + trust policy)
POST /api/lab/assume-role-101/assume body {principal_arn}
GET /api/lab/assume-role-101/loot?session_token=...
Goal: the trust policy lists Principal.AWS = '*' — a notorious mistake. Assume with ANY ARN and you get the flag from /loot.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/assume-role-101/
// reuse on the cli
// submit flag
// no solves yet