> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_create_login_profile.md).

# AWS\_CREATE\_LOGIN\_PROFILE

## Summary

|                                |                                                                                       |
| ------------------------------ | ------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**        | AWS\_CREATE\_LOGIN\_PROFILE                                                           |
| **Edge Type**                  | Attack Path                                                                           |
| **Affected Object Types**      | IAM Users                                                                             |
| **Exploitation Certainty**     | Certain                                                                               |
| **AWS IAM Action / Condition** | `iam:CreateLoginProfile` for target IAM user (related risk: `iam:UpdateLoginProfile`) |

## Description

`AWS_CREATE_LOGIN_PROFILE` is the ability to set an IAM console password for a user account.

An attacker who holds this permission can enable console access for an API-only user, set a known password, and sign in immediately. That converts a programmatic identity into an interactive one. Interactive sessions open up console-only actions that API workflows can't reach.

`iam:UpdateLoginProfile` carries the same risk. It resets the password of a user who already has a login profile, which is often more dangerous because it silently evicts the real user.

## Identification

### AWS CLI

Check whether the principal can create login profiles.

```bash
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:CreateLoginProfile \
  --resource-arns arn:aws:iam::123456789012:user/TargetUser
```

Check whether the target user already has a login profile.

```bash
aws iam get-login-profile --user-name TargetUser
```

If the command returns `NoSuchEntity`, no console password currently exists.

### AWS Console

* Open **IAM** -> **Users** -> select target user.
* Open **Security credentials**.
* Check **Console sign-in** status.
* Review who has IAM user credential management permissions.

## Exploitation

Create a console password for the target user.

```bash
aws iam create-login-profile \
  --user-name TargetUser \
  --password 'ExampleTempPassword123!' \
  --password-reset-required
```

After the profile is created, the attacker signs in to the console with that password.

If the attacker also has `iam:UpdateLoginProfile`, they can reset an existing console password, no new profile needed.

## Mitigation

* Restrict `iam:CreateLoginProfile` and `iam:UpdateLoginProfile` to trusted identity administrators.
* Disable console access for service accounts that should stay programmatic-only.
* Require MFA and strong passwords for any IAM user with console login.
* Prefer AWS IAM Identity Center and temporary role-based access over long-lived IAM users.

## Detection

Monitor CloudTrail for login profile changes.

* **Event source**: `iam.amazonaws.com`
* **Event names**:
  * `CreateLoginProfile`
  * `UpdateLoginProfile`
  * `DeleteLoginProfile`

Example lookup.

```bash
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateLoginProfile
```

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateLoginProfile.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateLoginProfile.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetLoginProfile.html>
* <https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html>