  Identity and Access Management (IAM) is an access control service in cloud
platforms. To securely manage cloud resources, customers need to configure IAM
to specify the access control rules for their cloud organizations. However,
incorrectly configured IAM can be exploited to cause a security attack such as
privilege escalation (PE), leading to severe economic loss. To detect such PEs
due to IAM misconfigurations, third-party cloud security services are commonly
used. The state-of-the-art services apply whitebox penetration testing
techniques, which require access to complete IAM configurations. However, the
configurations can contain sensitive information. To prevent the disclosure of
such information, customers need to manually anonymize the configuration.
  In this paper, we propose a precise greybox penetration testing approach
called TAC for third-party services to detect IAM PEs. To mitigate the dual
challenges of labor-intensive anonymization and potentially sensitive
information disclosures, TAC interacts with customers by selectively querying
only the essential information needed. Our key insight is that only a small
fraction of information in the IAM configuration is relevant to the IAM PE
detection. We first propose IAM modeling, enabling TAC to detect a broad class
of IAM PEs based on the partial information collected from queries. To improve
the efficiency and applicability of TAC, we aim to minimize interactions with
customers by applying Reinforcement Learning (RL) with Graph Neural Networks
(GNNs), allowing TAC to learn to make as few queries as possible. Experimental
results on both synthetic and real-world tasks show that, compared to
state-of-the-art whitebox approaches, TAC detects IAM PEs with competitively
low false negative rates, employing a limited number of queries.
