Privilege Escalation
iam:AddUserToGroup
An attacker with iam:AddUserToGroup adds their user to a more privileged group, inheriting its policies.
Required Permissions
Description
iam:AddUserToGroup places an IAM user into a group. All policies attached to that group become effective for the user immediately.
The hackaws agent only targets groups the caller is not already in and that have at least some permissions. It picks groups with higher effective privilege than the caller's current set, so the move is strictly an escalation.
Nothing on the user object itself changes. The only trace is the group membership and the API call.
Impact
The caller inherits every policy attached to the target group. If the group is an admin group, the caller has administrator access from the next request onward.
Detection
Alert on AddUserToGroup events where the UserName in the request matches the caller. Compare group membership snapshots over time. Watch for first-time additions to high-privilege groups.
Mitigation
Deny iam:AddUserToGroup from non-admin principals. Pin iam:GroupName in the Condition to prevent self-addition to privileged groups. Review group membership regularly.