AWS_ATTACH_ROLE_POLICY

Summary

Forestall ACL Alias	AWS_ATTACH_ROLE_POLICY
Edge Type	Attack Path
Affected Object Types	IAM Users, IAM Roles, IAM Groups
Exploitation Certainty	High
AWS IAM Action	iam:AttachRolePolicy on the target role

Description

A principal with iam:AttachRolePolicy can attach any managed policy to a target IAM role. That covers customer-managed and AWS-managed policies, including AdministratorAccess.

Once the policy is on the role, the attacker assumes the role, or gets a service or instance to assume it, and inherits whatever the role now grants.

A role that holds iam:AttachRolePolicy scoped to itself can escalate its own permissions.

The edge is (Attacker:AWSUser|AWSRole|AWSGroup) -[AWS_ATTACH_ROLE_POLICY]-> (TargetRole:AWSRole).

There is no precondition. Any role in the account that matches the resource ARN pattern is a valid target.

Identification

# List principals with iam:AttachRolePolicy
aws iam get-account-authorization-details \
  --filter User Role Group LocalManagedPolicy AWSManagedPolicy \
  --query "UserDetailList[?AttachedManagedPolicies[?contains(PolicyName, 'AttachRolePolicy')]].[UserName]"

# Simulate privilege check
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names iam:AttachRolePolicy \
  --resource-arns "arn:aws:iam::*:role/*"

PowerShell (AWS Tools):

Get-IAMAccountAuthorizationDetail -Filter Role | ForEach-Object {
    $_.AttachedManagedPolicies | Where-Object { $_.PolicyName -match "AttachRolePolicy" }
}

Exploitation

# Step 1: Attach AdministratorAccess to the target role
aws iam attach-role-policy \
  --role-name <target-role> \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# Step 2: Assume the now-escalated role
aws sts assume-role \
  --role-arn arn:aws:iam::<account-id>:role/<target-role> \
  --role-session-name escalation-session

Mitigation

• Restrict iam:AttachRolePolicy to dedicated IAM administrators. Deny it for service roles and instance profiles.

• Use permission boundaries to cap what any role can do, whatever policy gets attached.

• Apply SCPs to block attachment of Tier-0 policies like AdministratorAccess and IAMFullAccess outside approved admin pipelines.

• Audit role trust policies so no unintended principal can assume a high-privilege role.

Detection

CloudTrail Event	Description	Key Fields
AttachRolePolicy	A managed policy was attached to a role	requestParameters.roleName, requestParameters.policyArn, userIdentity.arn
AssumeRole	A role was assumed after being escalated	requestParameters.roleArn, userIdentity.arn

Alert on AttachRolePolicy where policyArn is a Tier-0 policy, or where the same principal shows up in both AttachRolePolicy and a later AssumeRole for the same role.

References

• AWS IAM: AttachRolePolicy API

• Rhino Security Labs: AWS IAM Privilege Escalation Methods

• AWS Security Best Practices: Least Privilege