AWS IAM Privilege Escalation via Policy Version Manipulation

This threat involves the abuse of AWS Identity and Access Management (IAM) API calls to escalate privileges without attaching new policies, which is a common indicator of unauthorized activity. By leveraging CreatePolicyVersion or SetDefaultPolicyVersion permissions on an existing customer-managed policy, an attacker can modify the permissions associated with a principal. This technique is effective because the changes are applied to existing policies already attached to roles or users, allowing attackers to broaden the scope of permissions silently. This method is particularly dangerous when the targeted policy is attached to administrative or break-glass roles. Organizations should monitor these API actions, particularly when performed by users or roles that are not designated automation service accounts.

Impact

Successful exploitation allows an attacker to elevate their effective permissions or those of a compromised role, potentially leading to full account takeover or unauthorized access to sensitive cloud resources. Because the policy modification occurs within an existing, legitimate policy object, the activity may bypass basic security alerts that look primarily for the attachment of new or unrecognized policies.

Recommendation

• Enable logging for CreatePolicyVersion and SetDefaultPolicyVersion events in AWS CloudTrail.
• Implement monitoring to identify users and roles performing these actions outside of known CI/CD or automation pipelines.
• Audit high-privilege IAM policies to identify which principals have the authority to update their own versioning.
• Deploy the detection logic provided below to identify non-standard usage of these policy management APIs.