Privilege Escalation
iam:DeleteRolePermissionsBoundary
An attacker with iam:DeleteRolePermissionsBoundary removes the permissions boundary capping a role, so the role's identity policies take full effect.
Required Permissions
Description
A permissions boundary is a managed policy that caps what a role can do. The role's effective permissions are the overlap of its identity policies and its boundary. When the identity policies grant more than the boundary allows, the boundary is the only thing holding the extra permissions back.
iam:DeleteRolePermissionsBoundary deletes that cap in one call. The identity policies stay exactly as they were, but with the boundary gone they now take full effect, so the role gains every action the boundary used to suppress.
The hackaws agent reads the boundary document and the role's identity policies, then determines which actions the boundary currently suppresses. It removes the boundary only when that suppressed set contains a useful primitive, such as an action another technique needs or a write, permission-management, or data-plane action. A boundary that already permits everything the identity policies grant is left in place, because deleting it would gain nothing. The boundary is removed in the live account and stays off until the cleanup command re-attaches the same policy.
Impact
The role keeps its identity policies but loses its cap, so its effective permissions jump to whatever those policies grant. Any principal or workload that assumes the role inherits the uncapped access until the boundary is restored.
Detection
Alert on CloudTrail DeleteRolePermissionsBoundary events, especially on roles whose identity policies are broader than their boundary. Pair the event with GetPolicy and GetPolicyVersion reads of the boundary that precede it. Reconcile which roles are expected to carry a boundary against a known baseline and flag any that lose one.
Mitigation
Deny iam:DeleteRolePermissionsBoundary and iam:PutRolePermissionsBoundary from non-admin principals with an SCP. Require that privileged roles always carry a boundary and alert when one is removed. Keep identity policies no broader than the boundary so removing the cap gains nothing.