> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_attached_policy.md).

# AWS\_ATTACHED\_POLICY

## Summary

|                                |                                                                                                                             |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**        | AWS\_ATTACHED\_POLICY                                                                                                       |
| **Edge Type**                  | Relationship                                                                                                                |
| **Affected Object Types**      | IAM Users, IAM Groups, IAM Roles, Customer Managed Policies, AWS Managed Policies                                           |
| **Exploitation Certainty**     | Certain                                                                                                                     |
| **AWS IAM Action / Condition** | Relationship visibility via `iam:ListAttachedUserPolicies`, `iam:ListAttachedGroupPolicies`, `iam:ListAttachedRolePolicies` |

## Description

`AWS_ATTACHED_POLICY` records that a managed IAM policy is attached to a user, group, or role.

This is a structural edge, not an exploitable action. What matters is the content of the attached policy. That is where the permissions live. The edge lets the graph trace effective permissions and escalation chains, because attached managed policies are how IAM hands permissions to identities.

## Identification

### AWS CLI

List policies attached to a user:

```bash
aws iam list-attached-user-policies --user-name TargetUser
```

List policies attached to a group:

```bash
aws iam list-attached-group-policies --group-name TargetGroup
```

List policies attached to a role:

```bash
aws iam list-attached-role-policies --role-name TargetRole
```

### AWS Console

* Open **IAM**.
* For **Users**, **Groups**, or **Roles**, open the target identity.
* Open the **Permissions** tab and review **Managed policies** attached.

## Exploitation

No direct exploit path exists for this edge. `AWS_ATTACHED_POLICY` shows what permissions an identity carries, not how to acquire new ones.

Abuse depends on the attached policy's content. If an attacker can modify attachments or swap policy versions, they can use that to escalate. The edge itself is passive.

## Mitigation

* Avoid attaching broad managed policies, especially full-admin ones.
* Review policy attachments regularly and remove what isn't needed.
* Prefer role-based access over direct user policy attachment.
* Use least-privilege managed policies scoped to specific actions and resources.

## Detection

Monitor attachment changes in CloudTrail:

* `AttachUserPolicy`, `DetachUserPolicy`
* `AttachGroupPolicy`, `DetachGroupPolicy`
* `AttachRolePolicy`, `DetachRolePolicy`

Pay closest attention to these events when the policy ARN involved is a broad or admin-level policy.

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedGroupPolicies.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedRolePolicies.html>
* <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html>