Privilege Escalation
iam:UpdateLoginProfile
An attacker with iam:UpdateLoginProfile resets a privileged user's console password, signs in as that user, and mints a long-term access key.
Required Permissions
Description
iam:UpdateLoginProfile replaces the console password of an existing IAM user. Unlike iam:CreateLoginProfile, this operation works even when the user already has a password, so any user with console access is in scope. The original password cannot be recovered.
The hackaws agent targets the most privileged user with a login profile, writes a fresh password, waits for propagation, and signs in through a headless browser. From the console it mints a long-term access key, which is CLI credentials that persist beyond the current session.
The destructive side effect is that the real user is locked out until an administrator resets the password back.
Impact
Long-term CLI credentials for the targeted user and a working console session. The real user is locked out until a password reset.
Detection
Alert on UpdateLoginProfile events where the UserName does not match the caller. Monitor for console sign-ins immediately after a password change. Alert on CreateAccessKey calls from a new source IP for a user that just had its password rotated.
Mitigation
Deny iam:UpdateLoginProfile from non-admin principals through an SCP. Enforce a Condition that pins iam:UserName to the caller so a user cannot reset anyone else's password. Require MFA on every console sign-in, which blocks the console path for the attacker.