Ctrlk

AWS_CAN_CREATE_POLICY_VERSION

Summary

FSProtect ACL Alias

AWS_CAN_CREATE_POLICY_VERSION

Edge Type

Attack Path

Affected Object Types

IAM Users, IAM Roles, Customer Managed Policies

Exploitation Certainty

Certain

AWS IAM Action / Condition

iam:CreatePolicyVersion on target customer-managed policy ARN; critical when attacker can set the new version as default

Description

AWS_CAN_CREATE_POLICY_VERSION represents the ability to create a new version of an existing customer-managed IAM policy.

This is a high-impact privilege escalation path because an attacker can:

  • Add broad permissions (for example Action: "*", Resource: "*") to a new policy version.

  • Make that malicious version the default immediately (or later through AWS_CAN_SET_DEFAULT_POLICY_VERSION).

  • Inherit administrative permissions through every user/role/group already attached to that policy.

Because the policy attachment graph usually already exists, changing policy content through a new version can produce instant, large-scale privilege expansion.

Identification

AWS CLI

Check whether a principal can create policy versions:

Inspect target policy versions:

AWS Console

  • Open IAM -> Policies.

  • Select a customer-managed policy.

  • Open Policy versions.

  • Review who can edit IAM policies and who can create a new policy version through delegated permissions.

Exploitation

AWS CLI

Create a malicious policy document:

Create a new version and set it as default:

If --set-as-default is blocked but version creation is allowed, attackers can chain with AWS_CAN_SET_DEFAULT_POLICY_VERSION.

Mitigation

  • Restrict iam:CreatePolicyVersion to tightly controlled automation identities only.

  • Scope IAM permissions to explicit policy ARNs instead of wildcards.

  • Use permission boundaries and SCPs to block broad policy version manipulation.

  • Review and remove unused customer-managed policies and stale delegations.

  • Require approval workflows for policy version changes.

Detection

Monitor IAM policy version creation in CloudTrail:

  • Event source: iam.amazonaws.com

  • Event name: CreatePolicyVersion

  • High-signal indicator: requestParameters.setAsDefault = true

Example lookup:

References

PreviousAWS_CAN_CREATE_LOGIN_PROFILENextAWS_CAN_DELETE_ACCESS_KEY

Last updated

Was this helpful?