> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_set_default_policy_version.md).

# AWS\_SET\_DEFAULT\_POLICY\_VERSION

## Summary

|                                |                                                                     |
| ------------------------------ | ------------------------------------------------------------------- |
| **Forestall ACL Alias**        | AWS\_SET\_DEFAULT\_POLICY\_VERSION                                  |
| **Edge Type**                  | Attack Path                                                         |
| **Affected Object Types**      | IAM Users, IAM Roles, Customer Managed Policies                     |
| **Exploitation Certainty**     | Certain                                                             |
| **AWS IAM Action / Condition** | `iam:SetDefaultPolicyVersion` on target customer-managed policy ARN |

## Description

`AWS_SET_DEFAULT_POLICY_VERSION` is the ability to change which version of a customer-managed IAM policy is active.

IAM evaluates only the **default** version of a managed policy. An attacker who can switch the default can re-activate an old privileged version, or promote a malicious version they created earlier. That escalates every identity attached to that policy without touching any attachments.

This edge is commonly chained with [`AWS_CREATE_POLICY_VERSION`](https://docs.forestall.io/fsprotect/edges/aws/aws_create_policy_version).

## Identification

### AWS CLI

Check whether a principal can set the default policy version:

```bash
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:SetDefaultPolicyVersion \
  --resource-arns arn:aws:iam::123456789012:policy/TargetPolicy
```

List versions and current default:

```bash
aws iam get-policy \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy

aws iam list-policy-versions \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy
```

### AWS Console

* Open **IAM** -> **Policies**.
* Select the target customer-managed policy.
* Open **Policy versions** and identify non-default versions.
* Confirm which principals can edit policy versions and switch the default.

## Exploitation

Set an existing version as default:

```bash
aws iam set-default-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/TargetPolicy \
  --version-id v3
```

If version `v3` is broader than the current default, every attached principal immediately inherits the expanded permissions.

## Mitigation

* Restrict `iam:SetDefaultPolicyVersion` to a minimal set of trusted identities.
* Delete old policy versions that are no longer needed.
* Require review and approval before switching the default version.
* Apply SCP guardrails to block uncontrolled version activation.

## Detection

Monitor CloudTrail for default version changes:

* **Event source**: `iam.amazonaws.com`
* **Event name**: `SetDefaultPolicyVersion`

Example lookup:

```bash
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=SetDefaultPolicyVersion
```

Correlate with `CreatePolicyVersion` events to spot full takeover chains.

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_SetDefaultPolicyVersion.html>
* <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html>
* <https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html>