AWS_ATTACHED_POLICY

Summary

Forestall ACL Alias	AWS_ATTACHED_POLICY
Edge Type	Relationship
Affected Object Types	IAM Users, IAM Groups, IAM Roles, Customer Managed Policies, AWS Managed Policies
Exploitation Certainty	Certain
AWS IAM Action / Condition	Relationship visibility via iam:ListAttachedUserPolicies, iam:ListAttachedGroupPolicies, iam:ListAttachedRolePolicies

Description

AWS_ATTACHED_POLICY records that a managed IAM policy is attached to a user, group, or role.

This is a structural edge, not an exploitable action. What matters is the content of the attached policy. That is where the permissions live. The edge lets the graph trace effective permissions and escalation chains, because attached managed policies are how IAM hands permissions to identities.

Identification

AWS CLI

List policies attached to a user:

aws iam list-attached-user-policies --user-name TargetUser

List policies attached to a group:

aws iam list-attached-group-policies --group-name TargetGroup

List policies attached to a role:

aws iam list-attached-role-policies --role-name TargetRole

AWS Console

• Open IAM.

• For Users, Groups, or Roles, open the target identity.

• Open the Permissions tab and review Managed policies attached.

Exploitation

No direct exploit path exists for this edge. AWS_ATTACHED_POLICY shows what permissions an identity carries, not how to acquire new ones.

Abuse depends on the attached policy's content. If an attacker can modify attachments or swap policy versions, they can use that to escalate. The edge itself is passive.

Mitigation

• Avoid attaching broad managed policies, especially full-admin ones.

• Review policy attachments regularly and remove what isn't needed.

• Prefer role-based access over direct user policy attachment.

• Use least-privilege managed policies scoped to specific actions and resources.

Detection

Monitor attachment changes in CloudTrail:

• AttachUserPolicy, DetachUserPolicy

• AttachGroupPolicy, DetachGroupPolicy

• AttachRolePolicy, DetachRolePolicy

Pay closest attention to these events when the policy ARN involved is a broad or admin-level policy.

References

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedGroupPolicies.html

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedRolePolicies.html

• https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html