AWS_ATTACH_GROUP_POLICY

Copy page

Summary


Forestall ACL Alias	AWS_ATTACH_GROUP_POLICY
Edge Type	Attack Path
Affected Object Types	IAM Users, IAM Roles, IAM Groups
Exploitation Certainty	High
AWS IAM Action	`iam:AttachGroupPolicy` on the target group

Description

A principal with iam:AttachGroupPolicy can attach any managed policy to a target IAM group. That covers customer-managed and AWS-managed policies. Every member of the group inherits its policies, so attaching AdministratorAccess escalates every current member. If the attacker is in the group, that includes them.

The edge is (Attacker:AWSUser|AWSRole|AWSGroup) -[AWS_ATTACH_GROUP_POLICY]-> (TargetGroup:AWSGroup).

Identification

# List principals with iam:AttachGroupPolicy
aws iam get-account-authorization-details \
  --filter User Role Group LocalManagedPolicy AWSManagedPolicy \
  --query "UserDetailList[?AttachedManagedPolicies[?contains(PolicyName, 'AttachGroupPolicy')]].[UserName]"

# Simulate privilege check for a specific principal
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names iam:AttachGroupPolicy \
  --resource-arns "arn:aws:iam::*:group/*"

PowerShell (AWS Tools):

Get-IAMAccountAuthorizationDetail -Filter User | ForEach-Object {
    $_.AttachedManagedPolicies | Where-Object { $_.PolicyName -match "AttachGroupPolicy" }
}

Exploitation

# Attach AdministratorAccess to the target group. Every member inherits it.
aws iam attach-group-policy \
  --group-name <target-group> \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Mitigation

Restrict iam:AttachGroupPolicy to dedicated IAM administrators. Deny it for all other roles and users.
Use permission boundaries to cap the most permissions any group can receive.
Apply SCPs to block attachment of AdministratorAccess and other Tier-0 policies without MFA or approval.
Audit group-attached policies with the AWS Config rule iam-group-attached-managed-policy-check.

Detection

CloudTrail Event	Description	Key Fields
`AttachGroupPolicy`	A managed policy was attached to a group	`requestParameters.groupName`, `requestParameters.policyArn`, `userIdentity.arn`

Alert when policyArn is AdministratorAccess or any Tier-0 policy, or when the caller isn’t in an approved IAM-admin role.

References