Privilege Escalation
iam:AttachUserPolicy
An attacker with iam:AttachUserPolicy attaches AdministratorAccess to any IAM user, including the attacker's own user.
Required Permissions
Description
iam:AttachUserPolicy binds a managed policy to an IAM user. Attaching AdministratorAccess to the caller's own user is one of the shortest paths to full account access in AWS: a single call, no role chaining, no new credentials needed.
The hackaws agent attaches arn:aws:iam::aws:policy/AdministratorAccess to each reachable user. The attachment is visible in IAM but requires the defender to look at the managed-policy attachments on the user, not just the inline policies.
Impact
The targeted user gains administrator access on the next request. Access persists for every active session and for every new session until the policy is detached.
Detection
Alert on AttachUserPolicy events where the PolicyArn grants broad access. Reconcile managed-policy attachments on every user against a baseline. Correlate with console sign-ins from the same user shortly after the attachment.
Mitigation
Restrict iam:AttachUserPolicy with an SCP that pins iam:PolicyARN to an allowlist. Apply permission boundaries to users so no attached policy can grant more than the boundary. Prefer group membership to direct policy attachment on users.