Privilege Escalation
iam:PutUserPolicy
An attacker with iam:PutUserPolicy writes an inline admin policy onto an IAM user, including the attacker's own user.
Required Permissions
Description
iam:PutUserPolicy writes inline policy documents onto an IAM user. If the caller is a user, the fastest path is to target their own account: a single API call turns the current session into an administrator.
The hackaws agent writes an inline policy named hackaws-privesc-test with Allow Action:* Resource:* to every user it can reach. There is no requirement that the user be inactive or new; the policy stacks on top of whatever is already attached.
The result persists until the inline policy is deleted. Rotating access keys, resetting the console password, and revoking sessions do not remove it.
Impact
Full administrator access for the targeted user. If the attacker targets their own user, the escalation is instant and does not require a role assumption.
Detection
Alert on PutUserPolicy events with policy documents containing Action:* and Resource:*. Monitor inline policies on all users and compare against an allowlist. Pay special attention to self-targeted calls where the UserName in the request matches the caller.
Mitigation
Deny iam:PutUserPolicy from non-admin principals with an SCP. Set permission boundaries on all users. Avoid granting any human user the right to modify its own policies.