Privilege Escalation
iam:PutRolePolicy
An attacker with iam:PutRolePolicy writes an inline admin policy onto an IAM role, giving every principal that can assume the role full account access.
Required Permissions
Description
iam:PutRolePolicy writes inline policy documents directly onto an IAM role. There is no cross-check on the content: a caller can attach an inline policy that allows every action on every resource.
The hackaws agent uses the permission to write an inline policy named hackaws-privesc-test on each role it can reach. The policy document is a single Allow Action:* Resource:* statement. Once attached, the role grants administrator access the next time it is assumed.
Scope is per role. Inline policies live on the role object, not the account, so defenders have to walk every role to find them. Rotating credentials or revoking sessions does not remove the policy; only an explicit delete-role-policy call does.
Impact
Full administrator access through any principal that can assume the targeted role, including services such as EC2, Lambda, and CodeBuild if the role is attached to them.
Detection
Alert on CloudTrail PutRolePolicy events with a policy document that contains Action:* and Resource:*. Flag inline policies whose names do not match an approved naming convention. Review inline policies on every role at least weekly.
Mitigation
Deny iam:PutRolePolicy from non-admin principals with an SCP. Set permission boundaries on the role so an inline policy cannot grant more than the boundary allows. Prefer managed policies with change control over inline policies.