AWS_CREATE_LOGIN_PROFILE

Summary

Forestall ACL Alias	AWS_CREATE_LOGIN_PROFILE
Edge Type	Attack Path
Affected Object Types	IAM Users
Exploitation Certainty	Certain
AWS IAM Action / Condition	iam:CreateLoginProfile for target IAM user (related risk: iam:UpdateLoginProfile)

Description

AWS_CREATE_LOGIN_PROFILE is the ability to set an IAM console password for a user account.

An attacker who holds this permission can enable console access for an API-only user, set a known password, and sign in immediately. That converts a programmatic identity into an interactive one. Interactive sessions open up console-only actions that API workflows can't reach.

iam:UpdateLoginProfile carries the same risk. It resets the password of a user who already has a login profile, which is often more dangerous because it silently evicts the real user.

Identification

AWS CLI

Check whether the principal can create login profiles.

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:CreateLoginProfile \
  --resource-arns arn:aws:iam::123456789012:user/TargetUser

Check whether the target user already has a login profile.

aws iam get-login-profile --user-name TargetUser

If the command returns NoSuchEntity, no console password currently exists.

AWS Console

• Open IAM -> Users -> select target user.

• Open Security credentials.

• Check Console sign-in status.

• Review who has IAM user credential management permissions.

Exploitation

Create a console password for the target user.

aws iam create-login-profile \
  --user-name TargetUser \
  --password 'ExampleTempPassword123!' \
  --password-reset-required

After the profile is created, the attacker signs in to the console with that password.

If the attacker also has iam:UpdateLoginProfile, they can reset an existing console password, no new profile needed.

Mitigation

• Restrict iam:CreateLoginProfile and iam:UpdateLoginProfile to trusted identity administrators.

• Disable console access for service accounts that should stay programmatic-only.

• Require MFA and strong passwords for any IAM user with console login.

• Prefer AWS IAM Identity Center and temporary role-based access over long-lived IAM users.

Detection

Monitor CloudTrail for login profile changes.

• Event source: iam.amazonaws.com

• Event names:

  • CreateLoginProfile

  • UpdateLoginProfile

  • DeleteLoginProfile

Example lookup.

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateLoginProfile

References

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateLoginProfile.html

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateLoginProfile.html

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetLoginProfile.html

• https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html