Privilege Escalation
iam:DeleteUserPermissionsBoundary
An attacker with iam:DeleteUserPermissionsBoundary removes the permissions boundary capping a user, so the user's identity policies take full effect.
Required Permissions
Description
A permissions boundary is a managed policy that caps what a user can do. The user's effective permissions are the overlap of its identity policies, its group policies, and its boundary. When those policies grant more than the boundary allows, the boundary is the only thing holding the extra permissions back.
iam:DeleteUserPermissionsBoundary deletes that cap in one call. The identity and group policies stay as they were, but with the boundary gone they now take full effect, so the user gains every action the boundary used to suppress.
The hackaws agent reads the boundary document and the user's identity and group policies, then determines which actions the boundary currently suppresses. It removes the boundary only when that suppressed set contains a useful primitive, such as an action another technique needs or a write, permission-management, or data-plane action. A boundary that already permits everything the policies grant is left in place. The boundary is removed in the live account and stays off until the cleanup command re-attaches the same policy.
Impact
The user keeps its identity and group policies but loses its cap, so its effective permissions jump to whatever those policies grant. The user's long-lived credentials then carry the uncapped access until the boundary is restored.
Detection
Alert on CloudTrail DeleteUserPermissionsBoundary events, especially on users whose identity or group policies are broader than their boundary. Pair the event with GetPolicy and GetPolicyVersion reads of the boundary that precede it. Reconcile which users are expected to carry a boundary against a known baseline.
Mitigation
Deny iam:DeleteUserPermissionsBoundary and iam:PutUserPermissionsBoundary from non-admin principals with an SCP. Require that privileged users always carry a boundary and alert when one is removed. Keep identity and group policies no broader than the boundary so removing the cap gains nothing.