Additional Cloud Role and Permission Assignment

An adversary-controlled cloud principal may gain persistence or elevated access when additional roles or permissions are assigned. In AWS, a role's trust policy controls who can assume it, while its permissions policy controls what it can do; role creation and permission attachment are separate changes. In Azure RBAC, an assignment binds a principal, role definition, and scope. ATT&CK lists Persistence and Privilege Escalation for T1098.003.