Privilege Escalation
iam:UpdateAssumeRolePolicy
An attacker with iam:UpdateAssumeRolePolicy modifies a role's trust policy to let their current foothold assume it, reaching roles they could not reach before.
Required Permissions
Description
iam:UpdateAssumeRolePolicy rewrites the trust policy of an IAM role. The trust policy decides who can assume the role, so writing to it is equivalent to handing yourself a role you did not previously have access to.
The hackaws agent appends a trust statement with a sentinel Sid of HackAWSPrivescTest that allows the caller's current foothold ARN to call sts:AssumeRole. The existing trust statements are kept so the change does not break the role for its real users.
The agent only targets roles the caller cannot already reach. The result is a new assume-role path from the caller to the targeted role, and from there to whatever the role grants.
Impact
Every IAM role in the account becomes reachable from the foothold. Roles with privileged managed policies, cross-account trust, or service-linked permissions can all be assumed.
Detection
Alert on UpdateAssumeRolePolicy events where the new policy adds an Allow statement with an external account or an attacker-controlled principal. Diff trust policies and flag any new sts:AssumeRole statements. Watch for added Sid values that do not match a known naming convention.
Mitigation
Deny iam:UpdateAssumeRolePolicy from non-admin principals through an SCP. Require trust policies to be managed through CI, not direct API calls. Review role trust policies on a schedule.