> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_update_login_profile.md).

# AWS\_UPDATE\_LOGIN\_PROFILE

## Summary

|                                |                                              |
| ------------------------------ | -------------------------------------------- |
| **Forestall ACL Alias**        | AWS\_UPDATE\_LOGIN\_PROFILE                  |
| **Edge Type**                  | Attack Path                                  |
| **Affected Object Types**      | IAM Users                                    |
| **Exploitation Certainty**     | Certain                                      |
| **AWS IAM Action / Condition** | `iam:UpdateLoginProfile` for target IAM user |

## Description

`AWS_UPDATE_LOGIN_PROFILE` is the ability to reset the AWS Management Console password for an IAM user who already has a login profile.

Unlike `AWS_CREATE_LOGIN_PROFILE`, this edge fires when the target user already has console access configured. An attacker with this permission resets the password to a known value, then signs in immediately as that user. If the target has no MFA requirement, access is instant. If the target is an administrator or billing owner, it is a direct path to full account takeover.

## Identification

### AWS CLI

Check whether the source principal has `iam:UpdateLoginProfile` on the target user:

```bash
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:UpdateLoginProfile \
  --resource-arns arn:aws:iam::123456789012:user/TargetUser
```

Verify whether the target user has an existing login profile:

```bash
aws iam get-login-profile --user-name TargetUser
```

If the command succeeds without a `NoSuchEntity` error, a console password exists and `UpdateLoginProfile` can reset it.

List users with login profiles across the account:

```bash
for u in $(aws iam list-users --query 'Users[].UserName' --output text); do
  aws iam get-login-profile --user-name "$u" 2>/dev/null \
    && echo "User $u has a login profile"
done
```

### AWS Console

* Open **IAM** -> **Users** -> select the source (attacker) user.
* Open **Permissions** tab and inspect effective policies for `iam:UpdateLoginProfile`.
* For the target user, open **Security credentials** -> **Console sign-in** to confirm a login profile exists.

## Exploitation

Reset the console password of the target user:

```bash
aws iam update-login-profile \
  --user-name TargetUser \
  --password 'NewKnownPassword123!' \
  --password-reset-required
```

After resetting, sign in to the AWS Management Console at:

```
https://<account-id>.signin.aws.amazon.com/console
```

using the new password. Without an MFA requirement on the target account, access is immediate.

## Mitigation

* Restrict `iam:UpdateLoginProfile` to a dedicated break-glass or identity administration role.
* Enforce MFA for all IAM users with console access. An attacker who resets a password still cannot sign in without the MFA device.
* Prefer AWS IAM Identity Center with SSO over local IAM user passwords.
* Monitor the `PasswordResetRequired` attribute and alert when it changes unexpectedly.
* Use SCPs to block `iam:UpdateLoginProfile` outside approved automation.

## Detection

Monitor CloudTrail for login profile changes:

* **Event source**: `iam.amazonaws.com`
* **Event name**: `UpdateLoginProfile`

Example lookup:

```bash
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=UpdateLoginProfile
```

Key investigation signals:

* The caller ARN differs from `requestParameters.userName`, a cross-user reset.
* The event follows an `AssumeRole` or an unusual API credential pattern.
* The target user holds `AdministratorAccess` or broad billing/IAM policies.

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateLoginProfile.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetLoginProfile.html>
* <https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html>
* <https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/>