Privilege Escalation
iam:PutGroupPolicy
An attacker with iam:PutGroupPolicy writes an inline admin policy onto an IAM group they belong to, escalating every user in that group.
Required Permissions
Description
iam:PutGroupPolicy writes inline policy documents onto an IAM group. The effective permissions of a group apply to every user in it, so a single call escalates the caller and every other member at once.
The hackaws agent writes an inline policy named hackaws-privesc-test with Allow Action:* Resource:* on every group the caller belongs to. If the caller is a role, the agent targets every group in the account.
The blast radius makes this both powerful and loud. Every member of the group inherits administrator access.
Impact
All members of the targeted group gain administrator access. For shared groups such as Developers, this often means dozens of users at once.
Detection
Alert on PutGroupPolicy events with wildcard actions. Compare group inline policies against a baseline. Investigate when the caller is itself a member of the group being modified.
Mitigation
Deny iam:PutGroupPolicy from non-admin principals with an SCP. Use permission boundaries on users to cap the effective permissions regardless of group membership. Keep groups small and single-purpose.