Privilege Escalation
iam:SetDefaultPolicyVersion
An attacker with iam:SetDefaultPolicyVersion switches a managed policy back to an older, broader version, escalating every attached principal.
Required Permissions
Description
iam:SetDefaultPolicyVersion changes which stored version of a managed policy is active. When an administrator tightens a policy by creating a narrower version as default, the old broader version often stays on disk. Any caller with this permission can switch the default back.
The hackaws agent lists versions on each customer-managed policy attached to the caller, reads each non-default version, and compares the expanded permission sets. It only switches to a version that is a strict superset of the current default. That keeps the caller's existing access intact and reliably increases it.
The change is a single pointer flip. No new policy content is authored, so a defender who only diffs policy content will miss it.
Impact
Every principal attached to the policy picks up the broader permissions of the restored version on the next request. If the previous default was a tightened replacement for an admin version, every attached principal becomes an administrator.
Detection
Alert on SetDefaultPolicyVersion events. Pair the event with ListPolicyVersions and GetPolicyVersion calls shortly before, which indicate reconnaissance. Monitor policies that have more than one version and age out old versions on a schedule.
Mitigation
Delete old policy versions after tightening a policy. Deny iam:SetDefaultPolicyVersion from non-admin principals through an SCP. Apply permission boundaries so a restored version cannot grant more than the boundary allows.