IAM privilege escalation (iam:PassRole, lambda:CreateFunction) - Metadata service exploitation (IMDS v1/v2) - S3 bucket misconfiguration exploitation - Cross-account access abuse - SSM session manager for C2