Privilege Escalation
iam:AttachGroupPolicy
An attacker with iam:AttachGroupPolicy attaches AdministratorAccess to a group they belong to, escalating every member of that group.
Required Permissions
Description
iam:AttachGroupPolicy binds a managed policy to an IAM group. The hackaws agent attaches AdministratorAccess to every group the caller belongs to. If the caller is a role, every group in the account is in scope.
Group-level attachments scale the blast radius. One call can grant admin to every user in a shared group.
Impact
Every member of the targeted group gains administrator access on the next request. Access survives individual user rotation.
Detection
Alert on AttachGroupPolicy events with high-privilege PolicyArn values. Review attached managed policies on every group against a baseline. Investigate when the caller is a member of the modified group.
Mitigation
Deny iam:AttachGroupPolicy from non-admin principals through an SCP that pins iam:PolicyARN to an allowlist. Apply permission boundaries on every user. Keep membership of privileged groups small.