AWS_UPDATE_LOGIN_PROFILE

Summary

Forestall ACL Alias	AWS_UPDATE_LOGIN_PROFILE
Edge Type	Attack Path
Affected Object Types	IAM Users
Exploitation Certainty	Certain
AWS IAM Action / Condition	iam:UpdateLoginProfile for target IAM user

Description

AWS_UPDATE_LOGIN_PROFILE is the ability to reset the AWS Management Console password for an IAM user who already has a login profile.

Unlike AWS_CREATE_LOGIN_PROFILE, this edge fires when the target user already has console access configured. An attacker with this permission resets the password to a known value, then signs in immediately as that user. If the target has no MFA requirement, access is instant. If the target is an administrator or billing owner, it is a direct path to full account takeover.

Identification

AWS CLI

Check whether the source principal has iam:UpdateLoginProfile on the target user:

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:UpdateLoginProfile \
  --resource-arns arn:aws:iam::123456789012:user/TargetUser

Verify whether the target user has an existing login profile:

aws iam get-login-profile --user-name TargetUser

If the command succeeds without a NoSuchEntity error, a console password exists and UpdateLoginProfile can reset it.

List users with login profiles across the account:

for u in $(aws iam list-users --query 'Users[].UserName' --output text); do
  aws iam get-login-profile --user-name "$u" 2>/dev/null \
    && echo "User $u has a login profile"
done

AWS Console

• Open IAM -> Users -> select the source (attacker) user.

• Open Permissions tab and inspect effective policies for iam:UpdateLoginProfile.

• For the target user, open Security credentials -> Console sign-in to confirm a login profile exists.

Exploitation

Reset the console password of the target user:

aws iam update-login-profile \
  --user-name TargetUser \
  --password 'NewKnownPassword123!' \
  --password-reset-required

After resetting, sign in to the AWS Management Console at:

https://<account-id>.signin.aws.amazon.com/console

using the new password. Without an MFA requirement on the target account, access is immediate.

Mitigation

• Restrict iam:UpdateLoginProfile to a dedicated break-glass or identity administration role.

• Enforce MFA for all IAM users with console access. An attacker who resets a password still cannot sign in without the MFA device.

• Prefer AWS IAM Identity Center with SSO over local IAM user passwords.

• Monitor the PasswordResetRequired attribute and alert when it changes unexpectedly.

• Use SCPs to block iam:UpdateLoginProfile outside approved automation.

Detection

Monitor CloudTrail for login profile changes:

• Event source: iam.amazonaws.com

• Event name: UpdateLoginProfile

Example lookup:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=UpdateLoginProfile

Key investigation signals:

• The caller ARN differs from requestParameters.userName, a cross-user reset.

• The event follows an AssumeRole or an unusual API credential pattern.

• The target user holds AdministratorAccess or broad billing/IAM policies.

References

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateLoginProfile.html

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetLoginProfile.html

• https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html

• https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/