Privilege Escalation
iam:AttachRolePolicy
An attacker with iam:AttachRolePolicy attaches the AWS-managed AdministratorAccess policy to any IAM role.
Required Permissions
Description
iam:AttachRolePolicy binds a managed policy to an IAM role. The policy can be an AWS-managed policy such as arn:aws:iam::aws:policy/AdministratorAccess, which grants Action:* Resource:*.
The hackaws agent attaches AdministratorAccess to each reachable role. The attachment takes effect immediately: the next session for that role has every permission in the account.
Unlike iam:PutRolePolicy, this technique leaves no inline document behind. The signal is only the attachment event itself and the list of attached managed policies, which some audits miss because the role's inline policies look clean.
Impact
The targeted role gains administrator access. Any workload that assumes the role, whether an EC2 instance profile, a Lambda function, or a user, inherits that access.
Detection
Alert on AttachRolePolicy events where the PolicyArn is AdministratorAccess, PowerUserAccess, IAMFullAccess, or any policy that grants wildcard permissions. Reconcile the list of attached managed policies on every role against a known baseline.
Mitigation
Deny iam:AttachRolePolicy except for a small list of PolicyArn values, enforced through a Condition on iam:PolicyARN in an SCP. Attach permission boundaries to roles so no attached policy can exceed the boundary.