AWS_UPDATE_LOGIN_PROFILE

Copy page

Summary


Forestall ACL Alias	AWS_UPDATE_LOGIN_PROFILE
Edge Type	Attack Path
Affected Object Types	IAM Users
Exploitation Certainty	Certain
AWS IAM Action / Condition	`iam:UpdateLoginProfile` for target IAM user

Description

AWS_UPDATE_LOGIN_PROFILE is the ability to reset the AWS Management Console password for an IAM user who already has a login profile.

Unlike AWS_CREATE_LOGIN_PROFILE, this edge fires when the target user already has console access configured. An attacker with this permission resets the password to a known value, then signs in immediately as that user. If the target has no MFA requirement, access is instant. If the target is an administrator or billing owner, it is a direct path to full account takeover.

Identification

AWS CLI

Check whether the source principal has iam:UpdateLoginProfile on the target user:

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:UpdateLoginProfile \
  --resource-arns arn:aws:iam::123456789012:user/TargetUser

Verify whether the target user has an existing login profile:

aws iam get-login-profile --user-name TargetUser

If the command succeeds without a NoSuchEntity error, a console password exists and UpdateLoginProfile can reset it.

List users with login profiles across the account:

for u in $(aws iam list-users --query 'Users[].UserName' --output text); do
  aws iam get-login-profile --user-name "$u" 2>/dev/null \
    && echo "User $u has a login profile"
done

AWS Console

Open IAM -> Users -> select the source (attacker) user.
Open Permissions tab and inspect effective policies for iam:UpdateLoginProfile.
For the target user, open Security credentials -> Console sign-in to confirm a login profile exists.

Exploitation

Reset the console password of the target user:

aws iam update-login-profile \
  --user-name TargetUser \
  --password 'NewKnownPassword123!' \
  --password-reset-required

After resetting, sign in to the AWS Management Console at:

https://<account-id>.signin.aws.amazon.com/console

using the new password. Without an MFA requirement on the target account, access is immediate.

Mitigation

Restrict iam:UpdateLoginProfile to a dedicated break-glass or identity administration role.
Enforce MFA for all IAM users with console access. An attacker who resets a password still cannot sign in without the MFA device.
Prefer AWS IAM Identity Center with SSO over local IAM user passwords.
Monitor the PasswordResetRequired attribute and alert when it changes unexpectedly.
Use SCPs to block iam:UpdateLoginProfile outside approved automation.

Detection

Monitor CloudTrail for login profile changes:

Event source: iam.amazonaws.com
Event name: UpdateLoginProfile

Example lookup:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=UpdateLoginProfile

Key investigation signals:

The caller ARN differs from requestParameters.userName, a cross-user reset.
The event follows an AssumeRole or an unusual API credential pattern.
The target user holds AdministratorAccess or broad billing/IAM policies.

Ask AI