AWS_SET_DEFAULT_POLICY_VERSION

Summary

Forestall ACL Alias	AWS_SET_DEFAULT_POLICY_VERSION
Edge Type	Attack Path
Affected Object Types	IAM Users, IAM Roles, Customer Managed Policies
Exploitation Certainty	Certain
AWS IAM Action / Condition	iam:SetDefaultPolicyVersion on target customer-managed policy ARN

Description

AWS_SET_DEFAULT_POLICY_VERSION is the ability to change which version of a customer-managed IAM policy is active.

IAM evaluates only the default version of a managed policy. An attacker who can switch the default can re-activate an old privileged version, or promote a malicious version they created earlier. That escalates every identity attached to that policy without touching any attachments.

This edge is commonly chained with AWS_CREATE_POLICY_VERSION.

Identification

AWS CLI

Check whether a principal can set the default policy version:

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:SetDefaultPolicyVersion \
  --resource-arns arn:aws:iam::123456789012:policy/TargetPolicy

List versions and current default:

aws iam get-policy \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy

aws iam list-policy-versions \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy

AWS Console

• Open IAM -> Policies.

• Select the target customer-managed policy.

• Open Policy versions and identify non-default versions.

• Confirm which principals can edit policy versions and switch the default.

Exploitation

Set an existing version as default:

aws iam set-default-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy \
  --version-id v3

If version v3 is broader than the current default, every attached principal immediately inherits the expanded permissions.

Mitigation

• Restrict iam:SetDefaultPolicyVersion to a minimal set of trusted identities.

• Delete old policy versions that are no longer needed.

• Require review and approval before switching the default version.

• Apply SCP guardrails to block uncontrolled version activation.

Detection

Monitor CloudTrail for default version changes:

• Event source: iam.amazonaws.com

• Event name: SetDefaultPolicyVersion

Example lookup:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=SetDefaultPolicyVersion

Correlate with CreatePolicyVersion events to spot full takeover chains.

References

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_SetDefaultPolicyVersion.html

• https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html

• https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html