AWS_IN_GROUP

Summary

Forestall ACL Alias	AWS_IN_GROUP
Edge Type	Relationship
Affected Object Types	IAM Users, IAM Groups
Exploitation Certainty	Certain
AWS IAM Action / Condition	Relationship visibility via iam:ListGroupsForUser; membership changes via iam:AddUserToGroup and iam:RemoveUserFromGroup

Description

AWS_IN_GROUP means an IAM user belongs to one or more IAM groups.

Group membership is how a user inherits permissions in IAM. A user picks up everything its groups grant:

• Managed policies attached to the group.

• Inline policies defined on the group.

On its own this edge grants nothing to exploit. It matters because it shows where a user's permissions actually come from. That is what you need to trace an escalation chain, especially alongside AWS_ATTACHED_POLICY.

Identification

AWS CLI

List groups for a user:

aws iam list-groups-for-user --user-name TargetUser

Inspect policy context of a group:

aws iam list-attached-group-policies --group-name TargetGroup
aws iam list-group-policies --group-name TargetGroup

Enumerate all user-group relationships:

for u in $(aws iam list-users --query 'Users[].UserName' --output text); do
  aws iam list-groups-for-user --user-name "$u" \
    --query "Groups[].{User:'$u',Group:GroupName}" --output table
done

AWS Console

• Open IAM -> Users -> select a user.

• Open Groups tab to review membership.

• Open each group to inspect managed and inline policies.

Exploitation

This edge has no exploit of its own. It is just membership. The privilege impact comes entirely from what the group's policies grant.

Mitigation

• Keep IAM groups purpose-specific and least-privilege.

• Regularly review group memberships for privileged groups.

• Remove unnecessary user memberships quickly.

• Use temporary role assumption for elevated tasks when possible.

Detection

Monitor CloudTrail for membership changes:

• AddUserToGroup

• RemoveUserFromGroup

Investigate events affecting privileged groups first.

References

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroupsForUser.html

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.html

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveUserFromGroup.html

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html