> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_attach_user_policy.md).

# AWS\_ATTACH\_USER\_POLICY

## Summary

|                            |                                           |
| -------------------------- | ----------------------------------------- |
| **Forestall ACL Alias**    | AWS\_ATTACH\_USER\_POLICY                 |
| **Edge Type**              | Attack Path                               |
| **Affected Object Types**  | IAM Users, IAM Roles                      |
| **Exploitation Certainty** | High                                      |
| **AWS IAM Action**         | `iam:AttachUserPolicy` on the target user |

## Description

`iam:AttachUserPolicy` lets a principal attach any managed policy to an IAM user. That includes AWS-managed ones like `AdministratorAccess`.

An attacker with this permission attaches an admin policy to a user they already control. That user becomes admin on the next call. If the target user is someone else, the attacker can escalate that account instead and use it later.

The edge is `(Attacker:AWSUser|AWSRole) -[AWS_ATTACH_USER_POLICY]-> (TargetUser:AWSUser)`.

## Identification

List who holds `iam:AttachUserPolicy`:

```bash
aws iam get-account-authorization-details \
  --filter User Role Group LocalManagedPolicy AWSManagedPolicy \
  --query "UserDetailList[?contains(AttachedManagedPolicies[*].PolicyName, 'AttachUserPolicy')]"
```

Check a specific principal with the policy simulator:

```bash
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-user-arn> \
  --action-names iam:AttachUserPolicy \
  --resource-arns "arn:aws:iam::*:user/*"
```

PowerShell (AWS Tools):

```powershell
Get-IAMAccountAuthorizationDetail -Filter User | ForEach-Object {
    $_.AttachedManagedPolicies | Where-Object { $_.PolicyName -match "AttachUserPolicy" }
}
```

## Exploitation

Attach an admin policy to a user you control:

```bash
aws iam attach-user-policy \
  --user-name attacker-user \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
```

Confirm it landed:

```bash
aws iam list-attached-user-policies --user-name attacker-user
```

Now use that user's credentials. It has full admin. If you can't sign in as the user yet, create an access key or set a login profile on the same user first.

## Mitigation

* Keep `iam:AttachUserPolicy` inside a small admin group. It is a direct route to admin.
* Scope the permission to specific user ARNs instead of `*`.
* Put a permissions boundary on your users so an attached policy can't exceed a ceiling.
* Alert whenever `AdministratorAccess` or another high-privilege managed policy gets attached.

## Detection

CloudTrail logs every attach call.

| Event              | Description                       | Key Fields                                                                      |
| ------------------ | --------------------------------- | ------------------------------------------------------------------------------- |
| `AttachUserPolicy` | Managed policy attached to a user | `requestParameters.userName`, `requestParameters.policyArn`, `userIdentity.arn` |

```bash
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AttachUserPolicy \
  --query 'Events[*].{Time:EventTime,Actor:Username}'
```

Worth a look:

* Any attach of `AdministratorAccess` to a user that isn't an admin.
* An attach where the actor and the target user are different identities.

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html>
* <https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html>
* <https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/>